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Preface 



Following the nuclear reactor accident at Chernobyl in the Soviet 
Union, Secretary of Energy John S. Herrington asked the National 
Academy of Sciences and the National Academy of Engineering to put 
together a committee with expertise in reactor-safety-related disci- 
plines to review safety and technical issues at the department's largest 
reactors — those categorized as "Class A reactors." The Academies 
formed the Conmiittee to Assess Safety and Technical Issues at DOE 
Reactors, which began its study in August 1986. 

At the committee's first meeting, DOE officials requested that 
the committee focus its initial efforts on the defense production 
reactors — the Class A reactors that produce plutonium and tritium 
for use in nuclear weapons. In October 1987 the committee released 
its first report. Safety Issues at the Defense Production Reactors. 
The report addressed specific safety and technical issues at the pro- 
duction reactors and provided recommendations for improving the 
overall structure and management of DOE's safety system. 

The present volume, the committee's final report, covers the re- 
mainder of the department's Class A reactors. It addresses safety and 
technical issues at five federal test and research reactors — facilities 
operated by private contractors for DOE for purposes of scientific re- 
search, radioisotope production, materials irradiation, and the devel- 
opment of advanced reactor technology. The DOE test and research 
reactors include the Advanced Test Reactor and the Experimental 

vii 
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Breeder Reactor II in Idaho, the Fast Flux Test Facility in Wash- 
ingt 1, the High Flux Beam Reactor in New York, and the High 
Flux Isotope Reactor in Tennessee. (In 1987 a sixth test and re- 
search reactor — the Oak Ridge Research Reactor in Tennessee — was 
ordered permanently shut down by DOE.) 

Although the original charge envisioned a study of safety issues 
at the DOE reactors in light of the Chernobyl accident, the commit- 
tee considered it more productive, given the unique designs of the 
DOE reactors, to focus on issues identified during the study. Hence, 
the committee interpreted its charge broadly, and the scope of the 
conunittee's two reports extends beyond a narrow examination of the 
technical lessons of the Chernobyl accident for the DOE reactors. 

In the course of its work, the committee examined extensive 
documentation on the test and research reactors from DOE and its 
contractors and conducted site visits at all five facilities. Additional 
meetings were held for briefings from high-ranking department of- 
ficials, from officials of the Office of Management and Budget, and 
from contractor employees on technical subjects of particular inter- 
est. The committee very much appreciates the assistance that was 
so generously given. 

One member of the committee, Herbert Kouts, is a long-time em- 
ployee of the Brookhaven National Laboratory. Because Brookhaven 
is the operating contractor of the High Flux Beam Reactor, Dr. 
Kouts excused himself from committee discussions concerning that 
reactor and played no part in the formulation of those sections of the 
report that deal with it. 

A number of events have transpired since the issuance of the 
committee's report on the defense production reactors that are ger- 
mane to this report. First, the department has endorsed all of the 
committee's recommendations and has taken a number of steps to 
Implement them. In response to the committee's observations con- 
Ccjming the need to strengthen internal oversight, the department's 
budget request for FY 1989 included large increases in funding and 
stuffing for the Environment, Safety, and Health (ES&H) organiza- 
tion. ES&H is developing an overall safety objective, with assistance 
from an ad hoc committee, and is undertaking revision and review 
of the system of departmental orders. DOE has signed a memoran- 
dum of agreement with the Institute of Nuclear Power Operations 
(INPO) that will permit the department to draw upon the breadth of 
experience that INPO has garnered in evaluating commercial nuclear 
power reactors. The department has also informed the committee 



that the technical issues discussed in the first report are being ag- 
gressively pursued by DOE and its contractors. And, m response 
to committee reconmiendations concerning the need for external, in- 
dependent review, the department formed an Advisory Committee 
on Nuclear Facility Safety. By May 1988 the advisory committee 
had begun meeting on a regular basis. These are important changes 
that will benefit all the reactors, and the conmiittee applauds the 
department's efforts. 

Second, as this report was going to press, C!ongress passed leg- 
islation that will create a permanent safety oversight board with 
responsibility for overseeing the department's defense nuclear facil- 
ities. Hence, the administrative structure for operating the DOE 
reactors will change in ways that are not yet well defined. The com- 
mittee has prepared this report to focus on issues that will remain 
significant regardless of how the administrative structure is modified. 

Third, during the course of the committee's deliberations on 
the production reactors, one of the test and research reactors — the 
High Flux Isotope Reactor at Oak Ridge, Tennessee— was shut down 
as a result of certain major deficiencies. The need to resolve these 
deficiencies has delayed restart. The situation is thus similar to 
that confronted by the committee in its examination of the defense 
production reactors; the N Reactor had been shut down for safety 
improvements in January 1987 following the publication of several 
critical reports by an outside panel of experts. (The department 
subsequently announced that the N Reactor would be placed in 
"cold standby" for an indefinite period.) The committee pointed out 
in its previous report that it had not reached any conclusions with 
regard to restart of the N Reactor. A similar disclaimer applies to 
this report insofar as restart of the High Flux Isotope Reactor is 
concerned. As noted in the committee's earlier report. 

Although the committee brings to its task a wealth of experience in 
the field of nuclear safety, it has neither the legal authority nor the 
capacity io conduct the in-depth scrutiny that would be necessary to 
judge the overall safety of any of DOE*s reactors. 

Nonetheless, it is hoped that the committee's obs'^rvations will assist 
the department in its evaluations. 

In examining the test and research reactors, the committee faced 
five extremely diverse facilities with different ages, missions, manage- 
ments, design philosophies, and degrees of modification and upgrade. 
Because the department's articulation of a safety objective and of an 
unambiguous regulatory framework is as yet unachieved — as noted 
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above, this effort is under way — the committee did not have the 
benefit of DOE benchmarks to guide in the evaluation of existing 
or planned operations. As a result, the committee has had to base 
its judgments on its experience in the field of reactor safety, call- 
ing attention to safety issues that require resolution and practices 
that seem to be obsolete or out of step with accepted norms. The 
committee hopes that the conclusions and recommendations in the 
report will lead to improvements at the test and research reactors in 
a variety of areas. 
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Executive Summary 



The United States operates five nuclear reactors to produce ra- 
dioisotopes for mediced, industrial, and military purposes; to provide 
neutron sources for use in scientific research; and to conduct irradi- 
ation and other experiments in support of the government's space, 
fusion, and advanced reactor programs. Collectively referred to in 
this report as the test and research reactors, these facilities are op- 
erated by private contractors for the Department of Energy (DOE). 
They include: the Advanced Test Reactor (ATR) and the Experi- 
mental Breeder Reactor II (EBR-II), located at the Idaho National 
Engineering Laboratory; the Fast Flux Test Facility (FFTF), lo- 
cated on the Hanford Federal Nuclear Reservation in the state of 
Washington; the High Flux Beam Reactor (HFBR) at Brookhaven 
National Laboratory on Long Island; and the High Flux Isotope 
Reactor (HFIR) at Oak Ridge National Laboratory in Tennessee. 

This report provides an aissessment of safety issues at the DOE 
test and research reactors. It identifies technical issues that are 
applicable to each of the reactors and offers conclusions and rec- 
ommendations relevant to their continued safe operation. It is a 
companion volume to an earlier committee report on the defense 
production reactors. As explained in that report, no attempt has 
been made to address whether any of the DOE reactors is "safe" or 
to define an acceptable level of risk for the DOE reactors. Although 
such matters are important, an evaluation of this kind would require 
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a balancing of costs and benefits that extends far beyond the limited 
scope and capability of this committee. Rather, the report consti- 
tutes an examination of a number of generic and specific safety issues 
that are important to improving the safe operation and management 
of DOE's nuclear facilities. 

The report is organized in two parts. Part A identifies six safety 
issues of generic relevance to two or more of the test and research 
reactors. These issues include the safety design philosophy of the test 
and research reactors; the conduct of ssifety reviews; the performance 
of probabilistic risk assessments; the reliance on reactor operators; 
the fragmented character of the DOE management structure; and the 
safety implications of the current budgetary climate for the test and 
research reactors. Part B provides an assessment of issues specific to 
each of the five reactors. 

This report, like its predecessor, raises a number of safety-related 
issues and provides recommendations that the committee hopes will 
be helpful in resolving them. The principal conclusions and recom- 
mendations contained in Parts A and B of this report are summarized 
below. The committee encourages readers of this report to review 
the conmiittee's previous volume, as many broad issues of safety 
management discussed in that volume are equally important at the 
test and research reactors. 

GENERIC SAFETY ISSUES 

The current system of line management of the DOE resu:tors 
comprises a fragmented collection of contractors, operations offices, 
and programmatic divisions in headquarters. The programmatic di- 
visions have limited capabilities in the area of reactor safety. In 
the current system, the capacity to carefully balance programmatic 
needs against the safety needs of the reactors is modest. The struc- 
ture tends to disperse responsibility for safety and seems to require 
decisions with safety consequences by organizations that are divorced 
from day-to-day safety responsibility. The previous report included a 
recommendation that DOE strengthen the internal organization re- 
sponsible for safety oversight of the reactors— the headquarters- based 
Office of the Assistant Secretary for Environment, Safety and Health 
(ES&H). Although the committee continues to hold the view that 
strengthening the ES&H organization is important — and applauds 
the department's efforts in that direction — it has come to the conclu- 
sion that the structure for line management of the Class A reactors 
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also needs significant improvement. DOE should examine whether 
line managem<;nt of leactor operations ought to be the responsibility 
of a central reactor operations group within the depsirtment. 

The FFTF was recently constructed and thus incorporates a 
wide variety of safety features. The other test and research reactors 
were designed before modem safety philosophy bad matured; as a 
result, they lack the full complement of redundant and diverse safety 
systems that are provided in modern commercial power reactors. In 
port this may be justified by lesser stored energy, smaller inventory 
of radionuclides, and in general more remote siting than conmiercial 
nuclear reactors. Nonetheless, the risk profiles of the five test and 
research reactors do vary significantly, and DOE currently lacks a 
clear conceptual framework for addressing safety issues at the reac- 
tors. The department needs to formulate a safety objective for the 
Class A reactors and determine through careful evaluation whether 
the test and research reactors, as currently configured, are capable 
of achieving that objective. The committee does not prejudge the 
conclusion; it merely urges that the issue be addressed forthrightly. 

Over time, the missions of some of the test and research reactors 
have changed, and the reactors have been modified, or reconfigured to 
conduct safety tests, in ways that are more in line with their revised 
missions than with their original ones. Some of the changes have 
occurred without the benefit of thorough external review. DOE needs 
to strengthen its requirements for the review of proposed changes to 
the test and research reactors. The reactor contractora who have 
not already done so should add independent members from outside 
organizations to their existing safety review committees in order to 
strengthen the review of safety issues. 

Because most of the test and research reactors were designed 
many years ago and because they have been modified to operate out- 
side their original design bases, prevention and mitigation of some 
potential accidents rely heavily on the proper and timely response 
of reactor operators. In extreme cases, operators might have to act 
in the presence of radiation or steam in order to prevent releases of 
radioactive materials to the environment. The department should 
examine the feasibility of installing equipment at the test and re- 
search reactors to ensure that responses to reactor accidents are not 
solely or primeurily dependent on operator actions. At a minimum, 
the contractors should provide the capability to operate from remote 
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consoles outside the reactor confinements those valves that are lo- 
cated withb the confinements and may be nt ied to prevent fuel 
damage. 

Probabilistic risk assessment (PRA) is an important method* 
ology for understanding and ranking the relative risks of accidents 
at nuclear reactors. It has become an important part of modem 
analyses for commercial reactors. Attitudes and approaches toward 
PRA at the test and research reactors, however, are inconsistent, 
and the PRAs that have been completed to date are not persuasive. 
DOE should require that all of the test and research reactors conduct 
PRAs using state-of-the-art techniques, complemented by state-of- 
the-art deterministic analyses. For its part, DOE needs to acquire 
the capability to oversee the PRA review process to ensure that re- 
viewers' comments are appropriately addressed. And, of course, any 
weaknesses in the plants that are revealed by the contractors' PRAs 
must also be confronted. In general, the execution of a PRA provides 
an important mechanism by which DOE and the contractors can gain 
greater insights into reactor safety systems. 

'*ais is a time of tight budgets in the federal government. The 
Ofiice of Management and Budget (0MB) has adopted a strategy 
of requiring safety and programmatic needs to compete for the lim- 
ited pool of federal dollars that has been allocated to the test and 
research reactors. While this strategy may be justified by the need 
to restrain the growth of the federal budget, it could have adverse 
safety implications unless special vigilance is maintained. Tc ensure 
that programmatic objectives do not intrude on the attainment of 
safety, the department should establish an unambiguous safety ob- 
jective \ ith clear safety requirements, and should strengthen line 
management to implement them. The department should also main- 
tain effective oversight by a revitalized ES&H organization and by 
an external oversight committee. DOE should identify and defend 
requests for funding for safety needs separately from those for pro- 
grammatic needs. Finally, DOE should formalize plans for the even- 
tual retirement and/or replacement of the older test and research 
reactors. 

TECHNICAL ISSUES AT THE FIVE REACTORS 

This part of the report deals with specific issues at each of 
the five test and reseairch reactors. One common theme is that, 
although modernization of safety analyses is occurring at some of 
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the test and research resu^tors, there appears to be no central guiding 
philosophy. The modernization efforts are guided by the diverse 
attitudes and safety philosophies of the DOE contractors, rather 
than by any apparent central departmental policy to upgrade and 
rationalize the analyses. Another common theme of Part B is that 
some of the operating contractors have not kept up to date with 
safety activities and ways of thinking about safety that have evolved 
within the commercial nuclear mdustry. 

Modernization of safety analyses at the Advanced Test Reactor 
(ATR) is proceedmg along an appropriate path. However, there is a 
need to develop greater understanding of potential hydrogen-related 
challenges to the ATR confinement, and there are numerous acci- 
dent analyses that remam to be completed. These analyses will be 
particularly mtricate owing to the unique design of the ATR. Ade- 
quate resources, sufficient time, and thorough peer review must be 
available in order for these analyses to produce credible results. In 
the ATR design, a reduction in the amount of water in the exper- 
imental loops results in an increase in the criticality of the reactor 
(a positive void coefficient of reactivity). This means that loss of 
water from and/or depressurization of one or more of the loops can 
result in a rapid increase in power, potentially resulting in extensive 
core damage. The committee knows of no practical design change 
that would remove this vulnerability ^ hile also allowing the reactor 
to continue to achieve its mission. Loop operators at the ATR are 
typically among the least trained personnel, are isolated from the 
mam control room, and have been involved in a number of recent 
incidents. The contractor and DOE need to upgrade the existing 
training program for experiment operators, and the program needs 
to include a more careful review of existing procedures based on ex- 
perience operating the experimental loops. ATR management should 
ensure that experienced operators are on duty in the experimental 
loop area during each shift. 

At the Experimental Breeder Reactor II (EBR-II), there are 
currently no plans to conduct a PRA of any kmd. Although the 
plant has a number of passive safety features that suggest a high 
level of plant safety, a PRA can help to determine whether the ex- 
pected strengths of the design, such as the shutdown cooling system, 
have unanticipated weaknesses. Even if the EBR-II design is found 
to perform well in transient-initiated accidents, other accident vul- 
nerabilities may exist. The contractor should conduct a PRA that 
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includes careful evaluation of the risk of refueling accidents, the re* 
liability of the EBR-II reactor protection system, and the reliability 
of containment isolation. 

The Fast Flux Test Facility (FFTF) at Hanford is in the midst 
of converting to the use of metal fuel. The FFTF fuel conversion 
presents a number of safety issues that are only partially resolved. 
Adequate resources and more realistic schedules may be needed to 
allc^ the completion of the necessary analytical and experimental 
work. Because operation of the reactor using metal fuel is a signifi- 
cant modification, in*depth reviews by the contractor's safety review 
conmiittee, the Office of the Assistant Secretary for Environment, 
Safety, and Health, and the DOE Advisory Conmiittee on Nuclear 
Facility Safety will be necessary. In the course of these reviews, 
particular attention needs to be devoted to analyses of transient 
over-power events and the behavior of new safety devices (so-called 
gas expansion modules) that will be relied upon after the conversion 
to metal fuels. 

The contractor is also considering a project that would transform 
the facility into a power producer. DOE should carefully weigh 
whether such a venture offers sufficient benefits to justify the added 
cost in increased complexity and diffusion of the FFTF mission. 

The FFTF contractor also needs to undertake a PRA. In light of 
the conversion to metal fuel, the PRA should examine the evolution 
of lo6s-of-flow and transient over-power events into core disruptive 
accidents using state-of-the-art methods. The use of FFTF's filtered 
vented containment to cope with a severe accident should be inves- 
tigated using the latest information about debris coolability, steel 
and concrete penetration rates, radioactive source terms, and the 
potential for containment pressurization. 

The High Flux Beam Reactor (HFBR) has been modified to 
operate at a power level above its original design basis. This modifi- 
cation has involved a significant change in the safety philosophy for 
the facility in that it has created the potential for fuel melting under 
loss-of-coolant conditions. Since many of the emergency operations 
include heavy reliance on reactor operators to respond to potential 
accidents, a realistic assessment should be made of potential doses 
to operators to ensure that adequate protection is provided both to 
individuals at the site and to the public in the event of an accident. 
In addition, the contractor's recent preliminary analyses of dynamic 
thermal-hydraulic effects during flow reversal following loss of forced 
flow conditions, and of potential reactivity accidents caused by the 
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addition of light water into the in-core thimbles, should be confirmed 
and subjected to independent peer review. Planned improvements to 
provide remote reading of water level in the core at stations where 
light water can be added to the reactor coolant system should be 
promptly implemented. 

The High Flux Isotope Reactor (HFIR) has been shut down 
aince November 1986 when unexpected embrittlement of the reactor 
pressure vessel was discovered. A range of management deficiencies 
was subsequently discovered. DOE must ensyre that the steps taken 
to correct deficiencies at HFIR continue to be effectively implemented 
both by the contractor aid by the local DOE operations oflSce. 

The HFIR pressure vessel has become embr/ctled, and further op- 
eration cannot be conducted in compliance with the original criterion 
for ensiiring pressure vessel integrity. The contractor has form^ilated 
an alternative strategy of operation, but thus far insufficient effort 
has been applied to a realistic assessment of the consequences of 
vessel failure. The contractor should reanalyze the consequences of 
vessel failure in light of modem knowledge of radionuclide releases 
and modem methods of accident analysis. 
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Introduction 



Following the April 26, 1986, accident that devastated Unit 
Four of the Chernobyl Nuclear Power Plant m the Soviet Union, 
the Secretary of Energy requested that the National Academy of 
Sciences and the National Academy of Engineering review safety and 
technical issues at the department's Class A reactors — those capable 
of producing more than 20 MW of thermal power. The committee 
began its study by focusing on the department's aefense production 
reactors and issued a report on that subject m October 1987. The 
committee then turned its efforts to a review of the department's 
remaining Class A reactors— the Advanced Test Reactor (ATR), 
the Experimental Breeder Reactor II (EBR-II), the Fast Flux Test 
Facility (FFTF), the High Flux Beam Reactor (HFBR), and the 
High Flux Isotope Reactor (HFIR). These are the test and research 
reactors — the subject of this report 

COMPARATIVE OVERVIEW OF THE 
TEST AND RESEARCH REACTORS 

The test and reseetrch reactors represent three distinct groups of 
facilities. The first consists of EBR-II and FFTF, which are under 
the budgetary and programmatic jurisdiction of DOE's Assistant 
Secretary for Nuclear Energy. They are unique in their use of liquid 
sodium metal as a coolant, and are, in fact, the only liquid metal 

9 



ERIC 



21 



10 



reactors (LMRs) in operation in the United States. Originally built 
as testbeds for the development of large-scale liquid metal reactors 
for use by the commercial power industry, EBR-II and FFTF are 
primarily used to test the eCFects of irradiation on developmental 
LMR materials, components, and fuels, and to investigate the pas- 
sive safety characteristics of LMR designs. Both reactors have had 
shifting and highly uncertain missions since the withdrawal of federal 
support for construction of a demonstration LMR — the Clinch River 
Breeder Reactor project. Funding for the Clinch River reactor was 
terminated by the Congress in 1983. 

The second group of test and research reactors consists of two re- 
actors producing especially high neutron fluxes— the high flux beam 
and high flux isotope reactors. Both HFBR and HFIR are under 
the budgetary and programmatic jurisdiction of the DOE Ofiicc of 
Energy Research. Although HFBR and HFIR can and are used on 
a relatively small scale for testing the effects of radiation on mate- 
rials, they were originally built for difiierent purposes. HFBR was 
constructed with neutron scattering research as its principal mis- 
sion, whereas HFIR was built with radioisotope production in mind. 
Together, HFBR and HFIR represeut the bulk of the nation's invest- 
ment in user facilities for neutron scattering research. As befits their 
status as user facilities, both reactors have separate areas set aside 
as experiment rooms where scientists can use beam tubes and can 
collect and analyze experimental data. In addition, over the last 20 
years HFIR has been the primary U.S. source for a variety of high- 
assay radioisotopes with important scientific, medical, and industrial 
uses. 

The ATR faUs in the third group of teactors. It differs firom 
the others in mission — it is the principal irradiation facility for the 
development of advanced naval reactor fuels and materials — and line 
responsibility for the reactor is not assigned to any single DOE 
program. Budgetary jurisdiction and decisions on what tests will 
be conducted in the reactor are the responsibility of the Deputy 
Assistant Secretary for Naval Reactors, while line responsibility for 
safety rests with the Assistant Secretary for Nuclear Energy. 

RADIONUCLIDE INVENTORIES AND DECAY POWER 

The Department of Energy's test and research reactors are small 
in comparison to defense production reactors and modern commer- 
cial nuclear power reactors. Table 1 provides a comparison of the 
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TABLE 1 Power Levels and Radionuclide Inventories 



Decay Heating Rate (MW) 
Radionuclide at Various Times After 

Operating Fuel Mass Inventory^ Shutdown 

Reactor Power (MWt) (kg) (Ci) 508 10,000s 



HFIR 85 11.9^ 4.3x10^ 2.8 0 63 

HFBR 60 12.4^ 2.1x10^ 2.7 0.52 

EBR-II 62.5 345^ 7.6x10^ 2.3 0.59 

ATR 250 39-46 7 2.4x10* 12.6 2.4 

PFTF 400 2,928 - 3.1x10*^ 20 
Commercial 

PWR 3,414 101,100^ 1.6x10^ 100 26 

Savannah 
River 

Reactor 2,915^ 113,000^ 2.2x10® 154 ^ 63^ 



- Radiologically important isotopes oi Kr, Xe, I, and Cs calculated at 
V shutdown for refueling 

U--Ai approximate value is given neglecting breeder material and test 
^ fuel. 

^ Range of U metal loadings. 

7 (U,Pu)0^ including blanket material. 

Power typically variei from 650 MW to 2,915 MW; all valuet in this row 
^ assume full power operation. 

- Derived on the basU of 1,240 kg of U-235 in the Mark 15 charge with an 
J enrichment of 1.1 percent. 

Derived from the ratio of decay power to operating power for the Mark 
31 charge. 

SOURCES: Alpert et al., 1986; Church et al., 1983; Petry et al., 1986; 
Steimke, 1986; EG&G Idaho, Inc., 1988s; Argonne National Laboratory, 
EBR-II Fission Product Inventory, 8100 MWD Q 62.5 MW Activity After 
Shutdown; Westinghouse Hanford Company, 1987x; Brookhaven National 
Laboratory, 19881; Martin Marietta Energy Systems, Inc., 1987aa. 



operating power levels of a typical commercial pressurized-water re- 
actor, the defense production reactors operated by DOE at Savannah 
River, and the five test and research reactors. As can be seen, the 
test and research reactors operate at thermal power in a range from 
60 to 400 MW, whereas a modern commercial power reactor and the 
Savannah River reactors typically have a thermal power of approx- 
imately 3,000 MW. This means that, other things being equal, the 
test and research reactors pose less risk than a Savannah River reac- 
tor or a commercial power reactor; the systems are at lower pressure. 
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and there is less energy in normal operation to ^drive" an accident 
or to disperse radionuclides. 

Table 1 also shows the amounts of fuel used in the test and 
research reactors. In new cores, the fuel mass of the test and research 
reactors is more than an order of niagnitude less than that of a typical 
commercial power reactor or a Savannah River reactor. Again, the 
smaller fuel mass, in conjunction with the lower total power, is 
indicative, other things being equal, of lesser risk. 

These differences in scale are accompanied by differences in com* 
plexity. With the possible exception of the liquid metal reactors 
(FFTF and EBR-II), the test and research reactors are generally far 
less complex in design than either the defense production reactors 
or commercial nuclear power plants; they have less cable and piping 
and fewer pumps, valves, and safety systems. Simplicity is generally 
a desirable characteristic — assuming a streamlined system provides 
adequate safety protections — because of reduced aggregate probabil- 
ity of component failure and ease of system maintenance, control, 
and analysis. 

If core cooling were to be lost m a reactor, radionuclides in the 
reactor fuel would provide the driving force, in the form of decay 
heat, for fuel melting and accident propagation. The rates of decay 
heat generation in the test and research reactor fuels are also shown 
in Table 1. In an absolute sense, the decay heating rates produced in 
test and research reactor fuel are all smaller than those produced in 
commercial nuclear reactor fuel. Thus, the systems needed to remove 
decay heat in an accident are smaller in these reactors than in com- 
mercial pressurized*water reactors or the Savannah River reactors. 
However, the decay heating rates per unit mass of fuel are larger for 
the test and research reactors than for typical commercial reactors. 
This indicates that under emergency conditions the time available to 
reestablish core cooling and prevent fuel damage is shorter. Hence, 
emergency core cooling is at least as important for the test and 
research reactors as it is for commercial reactors. 

Finally, Table 1 shows the inventories of the more volatile radio- 
nuclides — isotopes of krypton, xenon, cesium, and iodine. The in- 
ventories for the test and research reactors are all more than & factor 
of 3 (and at HFBR a factor of nearly 50) less than those in a typical 
commercial pressurized-water reactor or one of the Savannah River 
reactors. Nonetheless, the radionuclide inventories in the test and 
research reactor fuels are not insignificant. Even the smallest of the 
test and research reactors contains several million curies of volatile 
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radionuclides that must be controlled during an accident. Thus, al- 
though the potential threat at the test and research reactors may be 
appreciably less than at commercial reactors or at the production 
reactors, design and operation must be approached with care and 
vigilance* 
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Part A 
Generic Safety Issues 



Overview 



The Department of Energy (DOE) faces a formidable challenre 
in ensuring the safe operation of its Class A reactors for several 
reasons. First, the designs of the reactors are dissimilar to one an- 
other and to conunercial nuclear reactors. Hence, the methods of 
analysis used to evaluate the safety of either commercial reactors 
or other DOE reactors may need extensive modification before they 
can be appropriately applied to these facilities. Moreover, the ex- 
tensive experience of the nuclear utility industry with commercial 
reactor operation has not been thoroughly applied to the Class A 
reactors. The department and its contractors have maintained safety 
largely through their own efforts without effectively drawing upon 
the extensive support network that exists in the commercial reactor 
world. 

Second, the majority cf the reactors were designed in the 1950s 
and 1960s, and problems of physical aging, such as vessel and beam 
tube embrittlement, are now being encountered. Moreover, in the in- 
terval since the reactors were originally built, the demands of society 
^or safety of nuclear plants have increased. Thus, although severe fuel 
'damage during design-basis accidents may have been an acceptable 
^isk zt the time the reactors were built, the risk associated with such 
an accident may not be acceptable today, particularly if protection 
of the public would require that operators take emergency actions in 
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hazardous radiation and steam environments, as it might at some of 
the test and research reactors. 

Third, the reactors are operated under a fragmented manage- 
ment system. Responsibility for the reactors originally rested with 
the Atomic Energy Commission (AEC). Many of the regulatory and 
associated functions of the AEC were transferred in 1974 to the Nu- 
clear Regulatory Commission (NRC), but the responsibility for the 
Class A reactors was eventually lodged with DOE. Within DOE, the 
day-to-day management responsibility currently rests with local op- 
erations offices, while programmatic responsibility — including the re- 
sponsibility to seek funding for safety programs and modifications — is 
assigned to several different assistant secretaries. The transfer of re- 
sponsibility from AEC to DOE, and the division of responsibility 
within DOE, while perhaps aiding in the accomplishment of the vari- 
ety of missions of the department, has impeded the development of a 
coherent strategy for defining, achieving, and maintaining the safety 
of the Class A reactors. 

Fourth, as the programs have evolved, some reactors have been 
modified to enhance their capacity to serve their missions, and in 
some cases the missions have changed. For example, one of the reac- 
tors (HFBR) serving the programs of the Office of Energy Research 
now operates at a higher power level than specified in the original 
design. (The higher power level has yielded a greater neutron flux, 
which has increased the value of the reactor as a research tool.) One 
finds a similarly changing situation at FFTF. With the demise of 
the Clinch River Breeder Reactor program, the mission of FFTF 
has been redefined, and FFTF is now being used to conduct safety 
tests that were not part of the original mission of the reactor. In- 
deed, planning is under way to redirect the mission of FFTF again. 
(EBR-II provided yet another example of a reactor with a changing 
mission.) 

Operating nuclear reactors in ways that depart from their orig- 
inal design can have serious safet/ implications. Although DOE has 
recognized this fact and has examined the safety implications of most 
of the changes that have been made, the fact remains that the de- 
sign changes have, in some instances, reduced safety margins. (As 
discussed below, some important modifications to the HFIR reactor 
were not reviewed and approved by DOE prior to installation.) 

Fifth, as the committee noted in its report on the defense pro- 
duction reactors [National Research Council, 1987], there has been 
a change in the way safety is conceived and implemented. The AEC 
placed great reliance on its reactor contractors and could do so be- 
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cause the contractors' employees were instrumental in designing the 
reactors and had an intimate knowledge of them. As time has passed, 
some of the original contractors have relinquished operation of the 
plants, and most of the employees who were instrumental in the 
design of the reactors have retired. Concomitantly, the depth and 
strength of the contractor staffs have diminished, establishing a need 
for more formal processes to ensure safety. In addition, public atti- 
tudes toward reactov safety have evolved, and this has necessitated 
a departure from the more personal and informal management of 
reactors that existed in the past. DOE has had to adapt to this 
change, but has done so slowly and incompletely. 

Finally, as discussed in the previous report, the department has 
failed to articulate a coherent safety objective that clearly delineates 
the requirements that these reactors must satisfy. In the absence 
of such a clear safety benchmark, there is no well-defined basis to 
determine those areas in which improvement is needed. As a result, 
some critical decisions, including judgments as to when a particular 
reactor has reached the end of its effective life, are not guided by a 
coherent and accepted safety framework that balances the risks and 
benefits of particular missions. 

In the report on the production reactors, the committee urged 
the department to address the problems that these developments 
have created. It was recommended that DOE establish a clearly 
articulated and documented safety objective, that it specify and 
implement orders that reflect that objective, and that it maintain 
vigilance to ensure the objective is being satisfied. It was further 
recommended that the department strengthen its internal oversight 
arm (ES&H) and establish stron^; externstl oversight in a new ad- 
visory committee. DOE was also urged to expedite training aimed 
at restoring critical safety functions and controlling critical safety 
parameters m the event of abnormal conditions. Finally, the depart- 
ment was urged to address a aeries of other technical issues. The 
department has acknowledged the validity of these recommendations 
and has initiated actions to respond to them. While this effort is to 
be applauded, the problems are deep-rooted and will not yield im- 
mediately to solutions; they will require continued effort at all levels 
in the department for years to come. 

The committee's observations on the need for change have been 
reinforced by its examination of the test and research reactors. The 
previous recommendations are generally valid for these reactors as 
well. However, there are several points of a generic nature that 
deserve particular attention. 
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Conclusions and Recommendations 



SAFETY DESIGN PHILOSOPHY 



Conclusion: Several of the DOE's test and research reactors 
were designed and constructc:^> before modern safety philos- 
ophy had matured. Some of the reactors are not protected 
by sufficient defense-in-depth measures to prevent certain 
accidents that could cause partial or extensive fuel damage. 

A particular safety philosophy — termed defense-in-depth — was 
employed in the design of nearly all reactors that are operating today. 
Defense-in-depth aims to provide multiple lines of defense against 
damage and includes the incorporation of redundant and diverse 
engineered safety features that would be automatically actuated in 
order to ensure that accidents initiated by events with even very low 
probability (such as a double-ended break of a major coolant pipe) 
do not lead to damage. Modern commercial reactors not only have 
systems to control releases of radioactive materials in the event of 
fuel damage, they also have systems that are expected to preclude 
significant fuel damage. 

Although FFTF and, to a lesser extent, EBR-II were designed 
with a high degree of dcfense-in-^<'pth, accidents at the other test 
and research reactors involving single failures of reactor systems. 
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such as breaks in pipes, could lead to significant fuel melting, with 
the potential for the release of a substantial fraction of the inventory 
of radioactive material in the fuel to the confinement and possibly 
into the environment. Because of the comparatively small inventory 
of radionuclides in the cores of these reactors, and the mitigative 
effect of the safety systems that are available, the consequences of 
these accidents are calculated to be small for the general public — that 
is, less than the dose linwts prescribed by the NRC for design-basis 
accidents (10 CFR 100). 

The HFIR, for example, does not have an emergency core cooling 
system capable of dealing with large pipe breaks. As a result, loss- 
of-coolant accidents involving breaks larger than 3 in. are estimated 
to lead to extensive fuel damage. In the event of such accidents, 
doses at the site boundary are calculated to be less than the NRC 
limits found in 10 CFR 100, assuming that 100 percent of the fuel 
is damaged during the accident but that other systems function as 
designed to attenuate the release of volatile radionuclides. 

The approach to safety used in the design of the older test and 
reseeo'ch reactors was characteristic of the time in which they were 
built. By virtue of their small sizes and remote locations, it was felt 
that the reactors did not represent a serious hazard to the public, 
even if an accident were to occur involving significant fuel damage. 
It is not clear, however, that such an approach is acceptable today. 
The department needs to take appropriate steps to estimate the 
probability of events involving fuel damage at the test and research 
reactors, and ensure that those probabilities are acceptably small. 

kecommendation: Once DOE establishes its new safety objectives, 
it should carefully evaluate the degree to which the test and research 
reactors satisfy them. Thereafter, DOE should reevaluate compliance 
with safety objectives at regular intervals. 



Conclusion: There have been instances at the test and re- 
search reactors where design changes were implemented or 
tests conducted without the benefit of a formal, externally 
reviewed safety analysis. 



SAFETY REVIEW PROCESS 



Unreviewed Safety Questions 
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In its review of plant documentation at the test and research 
reactors, the conunittee found instances where design changes had 
been implemented or tests conducted that were outside the original 
design bases. For example, as discussed in greater detsul below, at 
HFIR the contractor implemented changes to components in the 
reactor, without the requisite review and approval by DOE, that 
increased the estimated probability of a core damage accident by 
2 orders of magnitude. (This problem was subsequently rectified.) 
Good practice dictates that formal analyses of the effect of changes 
to a reactor be conducted befoie the changes are implemented. 

Regulations governing the implementation of design changes are 
set out in 10 CFR 50.59 for cnniTr.erc;5l nuclear power plants licensed 
by the NRC. These regulations, and the supporting guidance on their 
implementation, prescribe a process for determining whether any 
proposed change in operations or in the configuration of plant systems 
involves an "unreviewed safety question." If an unreviewed safety 
question is determined to exist, the plant is expected to complete 
and submit to the NRC for approval prior to implementation an in- 
depth safety analysis of the proposed change. (An NRC licensee must 
also follow very formal procedures, subject to audit by the NRC, for 
the review of changes that are found not to constitute an unreviewed 
safety question.) 

In theory, DOB reactor contractors arc subject to a similar re- 
quirement. The department's orders include a provision that requires 
that proposed changes be examined to determine whether any unre- 
viewed safety question exists. If the change involves such a question, 
the cor '.f actor must submit a safety analysis to DOE for approval. 
This provision is important because it is one of the few mechanisms 
for assuring externd review of changes to the DOE reactors. The 
conmiittee found, however, that DOE has failed to provide suflS- 
ciently detailed guidance to the contractors to ensure that consistent 
procedures are used in analyzing proposed changes. DOE has also 
failed to closely audit contractor performance to ensure that unre- 
viewed safety questions arc being fiiUy addressed. 

Recommendation: DOB should atrengtken its existing requirements 
for the analysis of proposed changes to plant systems, proposed changes 
in procedures, proposed experiments, or other preplanned deviations 
from the previously analyzed safety design basis in order to ensure 
that changes to reactor operations that can affect safety undergo a 
thorough, formal, independent safety review prior to implementation. 
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Safety Review Committees 

Conclusion: Safety review committees have been set up by the 
contractors at each of the test and research reactors. These 
committees review plant safety, reactor operations, and the 
safety of experiments. In the case of the liquid metal cooled re- 
actors, they also review experiments on the plants themselves. 
Because almost all the members of these review committees 
are in-house contractor employees, the committees may not 
bring sufficient independent judgment to the consideration of 
safety matters. 

Contractors at the test and research reactors have established 
safety review conmiittees whose members are drawn from the plant, 
the rest of the organization at the site, or an affiliated laboratory. 
(At one reactor (HFIR) the in-house committee is complemented 
by an independent review committee that draws its members from 
outside the contractor organization; however, this second committee 
was established only at the begimiing of the current year and meets 
infrequently.) While the chairmen of some of the safety review com- 
mittees are empowered to call upon expert consultants from outside 
organizations, in practice such advice is seldom solicited. 

It is good practice for safety review committees to have a portion 
of the membership drawn from outside the operating company. Out- 
side membership can help the safety review committee achieve a more 
balanced and acceptable judgment on technical issues, particularly 
on contentious subjects on which there may be differences of opinion 
within the operating organization itself Independent members can 
also supply knowledge and experience from outside the organization 
and thus provide a mechanism for the cross-fertilization of ideas. 
Moreover, the presence of experienced independent members on a 
safety review committee can provide an important measure of public 
confidence in the integrity of the committee process. 

In recognition of the important role of the safety review com- 
mittees and to provide a sounder basis for audits, a set of general 
criteria and guidelines applicable to safety review committees would 
be useful. It is particularly important that the committees have the 
authority to set their own agenda and are free to examine safety is- 
sues of their own choosing, not solely those that are brought to them 
by DOE or the contractor. To ensure that the criteria and guidelines 
for safety review committees are implemented in a consistent fash- 
ion and the conmiittees are working effectively, a plan for regularly 
auditing the committees should be developed and implemented. 
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Recommendations: The Safety Review Committees for the test and 
research reactors should be strengthened by the addition of independent 
members, DOE should establish criteria and guidelines for the effec- 
tive operation of the committees, and should develop and implement 
plans for ES&H audits. 

Review of Safety Tests 

Conclusion: Although Argonne (EBR-II) and Westinghouse 
(FFTF) developed special procedures for their transient test- 
ing programs and had the programs reviewed internally, al- 
most no external (outside the company) rexnevJs were per- 
formed, other than by DOE staff. 

Safety tests are typically performed with reduced safety margins 
in comparison with those in place during normal plant operations. 
It is perhaps not surprising, therefore, that there is a history of ac- 
cidents occurring during the performance of safety tests at nuclear 
reactors. The accidents at Windscale (England), NRX (Canada), 
EBR-I (Idaho), and Chernobyl (Soviet Union) gJl occurred during 
such tests. Based in part on this historical record, the committee 
believes that safety tests at any reactor should be subjected to par- 
ticuleffly careful review. 

The transient testing program at EBR-II is intended to demon- 
strate the "inherent'* or passive safety characteristics of the metal- 
fueled, pool-type, liquid-metal-cooled reactor design of the EBR-II. 
By design, the series of tests involved significant decreases in plant 
safety margins and increased accident risks. In preparation for the 
test program, which began in 1984, test procedures were developed 
by the staff and were reviewed internally by the EBR-II safety and ex- 
periment review committees and by the ANL Reactor Safety Review 
Conmiittee comprising Argonne staff assigned to other parts of the 
laboratory. Temporary waivers from restrictions in reactor technical 
specifications were submitted for approval to the DOE Chicago op- 
erations ofiice, where they were reviewed by a safety program officer. 
They were also reviewed for concurrence by the Idaho operations of- 
fice and the program oftiv e (Nuclear Energy) at DOE headquarters. 
Similar types of reviews were undertaken for the transient testing 
program at FFTF. 

An important characteristic of the reviews at EBR-II and FFTF 
is that, for the most part, they were all performed internally. Vir- 
tually the only reviews of the safety tests at EBR-II and FFTF 
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conducted by individuals outside the contractor organizations were 
those by DOE, which has very limited capability to perform this 
function. 

Prior vo the breakup of the AEC, safety tests of the type con- 
ducted at EBR-n and FFTF would have been required to be sub- 
mitted for review by the Advisory Conmiittee on Reactor Safeguards 
(ACRS). DOE could have used the services of the ACRS under the 
current law, but elected not to refer these tests to that body. The 
ACRS is made up of knowledgeable mdividuals from a variety of or- 
ganizations and with a diversify of expertise, thus providing carefiil 
external review of technical issues. With the formation of DOE's new 
Advisory Conunittee on Nuclear Facility Safety, an option now exists 
for similar review of significant safety tests at the DOE reactors. 

Recommendation: Proposals to conduct significant safety tests, tike 
the transient test series conducted at EBR-IJ and FFTF, should be 
carefully reviewed in advance by the DOE Office of the Assistant Sec- 
retary for Environment, Safety, and Health and by the DOE Advisory 
Committee on Nuclear Facility Safety. More generally, DOE needs to 
establish criteria to determine the types of activities that will require 
review and approval by the DOE advisory committee. 



PROBABIX.ISTIC RISK ASSESSMENT 

Conclusion: Efforts to produce probabilistic risk assessments 
(PR As) for the test and research reactors are uneven, indi- 
eating that the value of a PRA in risk management is not 
uniformly appreciated by DOE and its contractors. 

Attitudes toward PRA at DOE and among the contractors of the 
five test and research reactors vary significantly. The ATR contractor 
is conducting a Level 3 PRA; the HFIR contractor has completed 
a Level 1 PRA; the HFBR contractor is about to begin a limited, 
low-priority PRA activity; and the EBRrll and FFTF contractors 
are not planning to undertake any PRA work at all. (As explained in 
the committee's report on the production reactors, a Level 1 PRA is 
limited to calc latiuns of the probabilities of fuel damage accidents. 
A Level 2 PRA includes estimates of the timing, types, and amounts 
of radioactive materials that could be released from the facility. And 
a Level 3 PRA includes calculations of risks to public health Bnd the 
economic consequences of potential releases.) 
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One of the arguments presented to the conunittee for not con- 
ducting PRAb for the test and research reactors was that the reactors 
contain small inventories of radioactive materials and the associated 
risk from accidental release is very small in comparison to the risk 
from commercial nuclear power plants. Although this assec«?ment of 
risk may be accurate, the comntiittee nonetheless believes that the 
insights to be gained from a PRA, in understanding plant safety 
and guiding decisions on plant modifications, fully warrant the effort 
and expense involved, even for the test and research reactors. The 
argument that the small size of the reactors translates into relatively 
little risk to public health does not alter the fact that the risk must 
be strictly controlled; as noted in Table 1, the radionuclide inven- 
tories in these reactors are not trivial. The PRA process provides 
a systematic methodology for exploring various accident scenarios 
and can lead to a better understanding of the importance to safety of 
various systems, designs, procedures, maintenance activities, and hu- 
man performance, and thereby can help to guide decisions affecting 
those matters. 

In the late 1970s, the nuclear power industry debated the rel- 
ative merits of PRA and convention^ deterministic analyses. By 
the 1980s, a general consensus had developed within the reactor 
conmiunity that both deterministic analysis and probabilistic risk 
analysis should be applied in understanding and managing the risks 
of nuclear reactors. The conmuttee does not accept the argument 
that deterministic analyses — with their reliance upon such iU«defined, 
qualitative terms as "hypothetical" and "highly unlikely" accidents- 
provide a sufficient basis for all safety decisions. Deterministic anal- 
yses simply cannot provide the insights into the relative importance 
of potential accidents or contributors to accidents as those derived 
from the use of probabilistic methods. Both methods should be used. 

The HFIR experience with PRA provides a good example of 
the value of PRA as a systematic evaluation tool. In 1985 an ad 
hoc conunittee at HFIR reconunended certain modifications to the 
reactor to improve irradiation capabilities (Martin Marietta Energy 
Systems, Inc., 1985a]. The first phase of the project involved redesign 
of the reactor target tower and associated reactor components in 
order to permit on-line measurements of instrumented target iamples 
during reactor operations. These modifications were being completed 
when the HFIR PRA was beguu In the course of conductmg the 
PRA, it was quickly discovered that a major pathway to core damage 
(one referred to as "flow blockage due to the target tower centering 
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ring coining out of its groove") had been created directly as a result 
of the modifications to the target tower. Indeed, the mean frequency 
of core damage attributed to this scenario was calculated to be 
very high (2.6 x 10"*^ per reactor year), and immediate action was 
taken to remedy the situation. An O-ring was removed from the 
target tower design, eliminating the scenario of principal concern. 
Additional modifications resulted in lowering the estimated <>verall 
core damage frequency to 5.1 x 10"* per reactor year. While this 
example raises questions concerning the adequacy of the original 
design of the target tower and the safety review that accompanied 
the design modification, it also illustrates the usefulness of PRAs for 
evaluating proposed plant modifications and for identifying changes 
to the plant or to the procedures that can reduce risk. 

The conmiittee's report on the defense production reactors high- 
lighted several features of PRAs that can add to their credibility. 
Two bear repeating here in connection with the test and research 
reactors. 

First, by their very nature, PRAs rely heavily on the judgment 
of experts. This is one of the reasons that makes an independent peer 
review of a PRA essential. The credibility of any review, of course, 
still depends, as well, on the quality of the reviewers and the scope 
of their effort. In order to ensure a probing review, it is generally 
recognized that reviewers should be selected from diverse sources 
(e.g., from academia, industry, and the national laboratories). There 
are indications that some of the test and research reactor contractors 
may not be following these guidelines — in one case, purportedly 
because of problems arising from federal laws relating to the need 
for competitive bidding in federal contracting [EG&G Idaho, 19881]. 
Furthermore, in the one instance to date where external reviewers 
have been assembled (HFIR), the committee found that the PRA 
contractor was not fully responsive to reviewers' comments, and there 
was inadequate oversight of the review by the reactor contrsurtor and 
by DOE (SAROS, 1988; Pickard, Lowe L Garrick, 1988). 

Second, while the overall structure of a PRA is fairly well estab- 
lished, there are some areas in which the methodology i** still evolv- 
ing. A state-of-the-art PRA would obviously encompass the latest 
methodological developments in these areas, which include einalyses 
of human reliability, potential external initiators of accidents (e.g., 
earthquakes, high winds, fires, and floods), model uncertainties, and 
the proper elicit^tion of expert opinion. The analysis of potential 
external accident initiators is an essential aspect of modern PRAs, 
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and the proper elicitation of expert opinion is of particular impor- 
tance to doe's reactors because of their unique designs. Formal, 
state-of-the-art methods for eliciting and using expert opinions are 
described in the technical literature, including a set of PRAs that is 
being developed for the NRC (NUREG-1150). 

There is a general need for an integrated approach that encom- 
passes the development and application of state-of-the-art probabilis- 
tic and deterministic analyses at the older test and research reactors. 
Consideration should be given to the development of a formal, in- 
tegrated safety assessment program (ISAP), along the lines of the 
ISAP initiated by the NRC at the Millstone I and Haddam Neck 
m_ clear power plants in 1985 or the ISAP-II recently proposed by the 
ACRS. 

Recommendation: All of the DOE Class A reactors should have Level 
1 PRAs. The need for Level 2 and Level S PRAs should be given 
careful consideration, particularly if a facility is expected to operate 
for an extended period of time, or if the insights they may provide are 
needed in evaluating the costs and benefits of future modifications. 

These PRAs should be performed using techniques that incorpo- 
rate state-of-the-art treatment of human reliability, external events, 
and uncertainty analysis and recent approaches to the systematic elic- 
itation of expert opinion. They should be subjected to a high-quality 
peer review, and DOE should acquirz the capability to oversee the PR A 
review process to ensure that PRA contractors are fully responsive to 
reviewers' comments. 

DOE should also consider developing a formal, integrated safety 
assessment program for the older test and research reactors. 

RELUNCE ON OPERATORS FOR EMERGENCY ACTION 

Conclusion: In response to potential accidents at some of the 
test and research reactors, reactor operators must open valves 
or scram the reactor manually because there are no alternative 
systems to prevent core damage and fission*product release. 
In extreme cases, some of these operations would have to be 
undertaken in hazardous steam and radiation environments. 

When the HFBR is operated at 60 MW, the operators may be re- 
quired to open certain valves inside the confinement in environments 
that could be hazardous to their health, in order to prevent poten- 
tial accidents from progressing to core damage and fission product 
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release. At the ATR, emergency procedures require operator action 
in order to mitigate potential design-basis core-damage accidents, 
again in circumstances in which the operators might have to act in 
a hazardous environment. Procedures involving heavy reliance on 
operators have also been proposed at HFIR and FFTF and approved 
by the safety review committees, although in both of these cases 
project management overruled i^e proposals. 

In general; it is poor practice to rely solely or even primarily 
on operator action for essential safety functions. Indeed, it is now 
customary in the commercial sector to include automated systems 
that provide adequate margins of safety against incorrect operator 
action or against complete failure of the operators to act. Such 
systems are obviously of particular importance if operators would 
otherwise have to perform critical functions in environments that 
could be hazardous to their health and that would endanger the 
public if not performed successfully. 

A critical lesson learned from the Chernobyl accident is the 
importance of the truning and retraining of reactor operators — 
both formal and on the job. This point was emphasized in the 
committee^s report on the defense production reactors, but it needs 
to be reaffirmed here since it applies to the test and research reactors 
as well. 

Recommendation: DOE should examine the feasibility of installing 
equipment at the test and research reactors to ensure that responses 
to reactor accidents are not primarily dependent on operator action. 
At a minimum, DOE should ensure that reactor operators have the 
capability to operate from remote consoles outside the confinements. 
Care must be taken to ensure that remote operation of these valves 
cannot be accomplished prior to reactor shutdown, and more impor- 
tantly, to ensure that installation of a remote console reduces rather 
than increases accident risks. 

DOE MANAGEMENT OF REACTOR OPERATIONS 

Conclusion: Management responsibility for safety within the 
Department of Energy is fragmented. The current division of 
responsibility may inhibit the formulation and implementa- 
tion of coherent and uniform design requirements and opera- 
tional practices. 
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The Department of Energy asserts that the assurance of safety 
is a line responsibility, subject to oversight by the ES&H organiza- 
tion in headquarters. The report on the defense production reactors 
emphasized the importance of strengthening the ES&H organization 
to ensure that the safety oversight function is performed vigorously. 
Strengthening the ES&H organization was thought to be particularly 
important for the defense production reactors, and we hold the same 
view for the test and research reactors as well. However, the commit- 
tee has come to the conclusion that the structure of line management 
within DOE may also need to be improved. 

The test and research reactors are operated by five different 
contractors, with responsibility for day-to-day oversight delegated to 
"local*" DOE operations offices that report to the Under Secretary. 
(Largely for historical reasons, the Chicago operations office has 
responsibility for both the HFBR on Long Island and the EBR- 
n in Idaho, even though there is an Idaho operations office with 
responsibility for the ATR.) In addition to contractors and operations 
offices, there are several different divisions at DOE headquarters with 
programmatic responsibility for operation of the test and research 
reactors. Two of the test and research reactors (HFIR and HFBR) are 
within the progranrunatic purview of the Office of Energy Research. 
Another two (EBR-II and FFTF) are programmatically important 
to the operations of the Assistant Secretary for Nuclear Energy. And 
one reactor (ATR) supports activities that are almost exclusively 
part of the programs of the Deputy Assistant Secretary for Naval 
Reactors. 

The multiplicity of contractors, operations offices, and program- 
matic divisions at headquarters, along with the diversity of missions 
of the reactors, has led to considerable unevenness in operating prac- 
tices. The suitability of the existing arrangement is undermined by 
the absence of adequate staff in the DOE line management who are 
sophisticated on safety and operational matters, and by the fact that 
ESkU is not yet sufficiently strong to establish a unified and coher- 
ent safety strategy. In effect, the system relies almost exclusively on 
the skills and competence of the contractors. While the contractors 
are necessarily the first line of defense, the ultimate responsibility for 
safety must reside with DOE. 

The committee thus finds a fragmented line management struc- 
ture that serves to diffuse responsibility and, indeed, may result in 
organizations that are divorced from direct safety responsibility hav- 
ing to make decisions of immediate safety significance. For example, 
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funding decisions for the reaictors, including funding for safety up* 
grades, are made within the programmatic oHices at headquarters, 
whereas real knowledge of the reaictors resides almost entirely in a 
contrau:tor responsive to a local operations ofRce. (The head of the 
local operations ofRce does have a opportunity to petition the Un- 
der Secretary on funding matter^ — in effect, to bypass the program 
offices — but this authority is seldom exercised.) Not surprisingly, 
perhaps, the current structure has failed to produce consistently 
rational approeiches to prioritizing technical issues and allocating 
resources at the various facilities. 

If true line responsibility for safety is to be realized, there may 
be advantages in consolidating line responsibility in a single depart- 
mental entity in charge of supervising the contractors at all DOE 
reactors. This activity might be assigned to an existing DOE office, 
or it might be established in a separate operating division reporting 
directly to the Under Secretary. Such a change might enable more 
efficient use of knowledgeable staff, help promote consistency across 
the department, and encourage and facilitate wider application of 
safety lessons among the reactors. 

There are difficulties in reorganization: the reactors have diverse 
missions, tha responsibilities for funding are diffused, and there is an 
historical relationship between headquarters and the local operations 
offices. Further nore, the advantages to be gained from centraliza- 
tion of reau:tor operations would have to be balanced agains^ the 
disr>iptive effects of such a change. Resolution of such organiza ional 
issues goes beyond the purview and expertise of the committee; yet, 
because these particular institutional questions can have a direct 
bearing ^n safety, the department should consider restructuring its 
management of reactor operations. 

Whether DOE does or does not establish a central operations 
group, two other measures would be helpful in lessening the frag- 
meatizing effects of the current structure. First, in order to ssist 
DOE contractors in arriving at consistent and balanced allocation 
decisions, a clear, consistent, risk-based methodology for prioritizing 
technical issues needs to be developed. Second, there needs to be a 
better means of faci^'tating communication among the various DOE 
organizations and the reactor contractors. 

Recommendation: DOE should examine whether the line management 
of reactor operations can and should be made the responsibility of a 
central reactor operations group. 
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DOE should develop and apply a clear and consistent risk-based 
methodology for prioritizing and allocating resources to safety issues 
at the Class A reactors, 

DOE should also establish one or more annual meetings for key 
department and contractor personnel to explore potential solutions to 
safety issues at the Class A reactors. 

BUDGETARY IMPACTS 

Conclusion: Tight budgets can be expected for the indefi- 
nite futu.^ for the Department's test and research reactors, 
creating pressures on the contractors and the Department to 
postpone needed safety improvements in order to maintain 
existing programs. 

Representatives from 0MB made clear to the committee that, 
insofar as the administration is concerned, the programs that sup- 
port the test and research reactors will not receive extraordinary 
funding to respond to safety problems [National Research Council, 
1988]. Rathei, the department will be expected to accommodate any 
funding to respond to safety (or other) problems from the budget 
allocation that otherwise would be made available for program ac- 
tivities. Because the activities that are being pursued at the test and 
research reactors do not have high politicsd visibility, the Congress is 
not likely to intervene to alter significantly the 0MB budget strat- 
egy. Although the 0MB approach may be justified by the need to 
restrain the growth in the federal budget, it must be recognized that, 
absent special vigilance, such a strategy could have adverse safety 
implications. 

To the extent that funds to respond to safety concerns must be 
taken from program budgets, there will be uriderstandable pressures 
on line management (the contractor and the DOE program offices) 
to ensure that the achievement of safety objectives does not have 
an adverse impact on program objectives. The committee has no 
evidence thai; these pressures have resulted m inappropriate actions 
by line management but believes that specific actions are needed to 
ensure that safety margins are maintained. Two actions would assist 
in this effort. 

1. Safety Framework. As noted earlier, in the 1987 report on 
the defense production reactors, it was found that the department 
had feiiled to articulate an operationally meaningful safety objective 
and to establish a clear set of safety requirements. The committee's 
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observations as to the need for such a framework in connection with 
the production reactors apply with full force to the test and research 
reactors, although it might be appropriate to recognize the differences 
between the production reactors and the test and research reactors 
in such a framework. In the abeence of such a safety freimework, 
there might be a tendency for safety to diminish over time in the face 
of budgetary pressures. Each year of safe operation may inappropri- 
ately be seen to justify an incremental diminution of safety margins. 
Expensive safety upgrades might tend to be deferred so that research 
or other programmatic eu:tivities will not be reduced. Limitations on 
the budget thus inevitably provide an incentive to "make do^ with 
existing systems and to avoid upgrades until absolutely necessary or, 
worse, until after an accident has occurred. (Deferral of maintenance 
and safety upgrades for cost reasons occurred at the N Reactor in 
the late 1970s.) The establishment of an unambiguous safety objec- 
tive and of clear safety requirements would provide a benchmark by 
which to measure the adequacy of safety systems and operational 
performance. The establishment of a strong safety framework can 
thus serve to avoid any tendency to reduce existing safety margins 
at the DOE reactors. 

2. Management The report on the production reactors em- 
phasized the importance of strengthening the management structure 
by which the department seeks to ensure safe operation. It noted 
the importance of the continued strengthening of the independent 
oversight of the reactors by bolstering the organization led by the 
Assistant Secretary of Environment, Safety, and Health (ES&H) 
and by establishing an external oversight committee. T'^ese rec- 
onmiended organizational changes also apply to the other Class A 
reactors. The ES&H organization reports directly to the Under Sec- 
retary and does not have any direct responsibility for the missions 
of the reactors. Vigilant examination of the safety of the reactors by 
this organization — coupled with participation in the department's 
budget process — can thus serve to ensure that programmatic ob- 
jectives do not intrude inappropriately on the attainment of saiety. 
Similarly, the examination of safety issues by an aggressive oversight 
group is important to ensure that problems at the test and research 
reactors are detected and corrected expeditiously. 

Budgetary constraints are of particular concern for the older 
test and research reactori, such as HFIR, HFBR, and EBR-II. Each 
of these reactors is experiencing deterioration because of aging. At 
both HFIR and HFBR, irradiation is embrittling the primary coolant 
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system pressure boundaries of the reactors. Although an exemplary 
study of plant aging at EBR-II did not reveal any problems of imme- 
diate concern, over time more and more of the resources available for 
the older reactors will have to be consumed in the effort to counteract 
aging, simply to maintain the existing safety margins. Eventually, 
given the current budgetary outlook and increasing signs of facility 
deterioration, retirement and/or replacement of the facilities is likely 
to be more cost effective than continuing to struggle to meet the 
department's safety standards. The committee believes that it is not 
premature to undertake serious planning for the retirement and, as 
appropriate, re^'>lacement of the department's older reactors. 

Recommendation: To ensure continued safe operation of the Class A 
reactors in the face of budget constraints, DOE should establish an 
unambiguous safety objective and clear safety requirements and should 
maintain vigorous and effective oversight of safety both by a revitalized 
ES&H organization and by an external oversight committee. 

To assist in mitigating the competition between safety and pro- 
grammatic goals, DOE's budget requects should identify and defend 
major safety items separately from requests for programmatic pur- 
poses. 

In view of existing budgetary constraints and incrci^ing signs of 
facility deterioration due to aging, DOE should formalize vlans for the 
eventual retirement and/or replacement of the older test and research 
reactors. 
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PartB 

Technical Issues at the Five Reactors 



Introduction 



The sections that follow provide brief descriptions of the five 
reactors and their recent operating histories, along with discussions of 
specific technical issues. The discussion of these issues in connection 
with any one reactor may not apply fully to the others for two 
reasons: diversity and inccasistency. 

The degree of diversity in the designs of the te^* and research 
reactors is readily apparent from the reactor descriptions. In addi- 
tion, the fact that the test and research reactors are operated by 
five different contractors with a range of technical and management 
capabilities has resulted in further diversity among the facilities. 

Although some inconsistency in the application of standards may 
be the inevitable result of the diversity among the reactors, there is 
a residuum of inconsistency that reflects the department's approach 
to management of the reactors. DOE has not provided a common 
safety framework for the interpretation of its orders, resulting in the 
disparate implementation of DOE requirements and modern safety 
standards. 

The chapters that follow also establish that modernization of the 
reactors is occurring at different paces and with different objectives; 
the tools that are being applied in conducting accident analyses differ 
markedly; and the depth of analyses accompanying modifications and 
other proposed changes in operations varies significantly. 
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Advanced Test Reactor (ATR) 



The A^-^vanced Test Reactor (ATR) is a light-water reactor v;ith 
a thermal power of 250 MW. It is located at the Test Reactor Area 
of the Idaho National Engineering Laboratory, approximately 40 mi. 
west of Idaho Falls. The ATR went critical in 1967 and was raised to 
full power in 1969. Its basic mission is the irradiation of reactor fuels 
and materials, almost exclusively for the Naval Reactors Program. 
The reactor is also used to produce a small quantity of cobalt 60 
and other isotopes for commercial use. The operating contractor of 
the reactor is EG&G Idaho, Inc. The ATR has a staff of 272, and a 
current annual operating budget of $38.5 million. 

The ATR is unusual in that the fuel is not in a compact core. 
Seen from above, the core looks like a curvy ribbon, winding in 
and around a three-by-three array of irradiation positions (see ATR 
core cross-section print and back cover). The fuel configuration thus 
resembles the outline of a four-leaf clover. The total length of the 
ribbon of fuel around the four lobes in the core is about 11 ft. The 
largest dimension, diagonally across two opposite lobes, is 3 ft. 

The power level of each of the four lobes can be varied from 
17 to 60 MW. There are four large beryllium cylinders arranged 
around the outside of each lobe, and each cylinder has a hafnium 
absorber covering 120'' of its surface. If these cylinders are rotated 
so that the hafnium faces the fuel, the local reactivity (and hence 
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the local power level) is lowered. In addition, there are six smaller 
hafnium control rods on the inside of each lobe. These rods are used 
mostly to compensate for fuel burnup. In order to minimize power 
distortion, any individual rod is usually either fully inserted into or 
fully removed from the core. Finally, for shutdown purposes there 
are six fast-acting safety rods that also use hafnium absorbers. 

There are 40 identical fuel assemblies, each with two aluminum 
sideplates angled at 45^ to each other. The sideplates hold the curved 
aluminum-^lad fuel plates. There are 19 plates in each assembly. The 
plates are 4 ft high by 0.05 in. thick, with the length of the plate 
arc increasing from 2.4 in. at the inner radius to 4.4 in. at the 
outer radius. Typical coolant spacing between the plates is 0.078 in. 
The innermost and outermost plates are approximately double the 
thickness of the other plates. The fuel is an intermetallic compound of 
aluminum and uranium (UAlx). The uranium is 93 percent enriched, 
and there are 39 to 46 kg of U-235 in a fresh core. The maximum 
flux is 1.0 X 10^^ neutrons/cm^/s. Both the total flux and the energy 
spectrum are strongly dependent on position in and around the core. 

The reactor vessel is solid stainless steei, 12 ft in diameter and 
35 ft high, with walls 2 in. thick. Coolant water enters the vessel 
through two pipes at the bottom, flows upward in the vessel out- 
side the cylindrical tanks that support and contain the core, and 
enters the open part of the vessel above the core. The coolant flows 
downward through the core at 47,000 gpm. The temperatire rises 
from 125® F at the vessel inlet to 167** F at the outlet, as the pres- 
sure drops from 355 psi to 255 psi. The fuel is designed to retain 
its integrity at surface temperatures up to 368**?, above which plate 
buckling initiates. Four outlet pipes at the bottom of the core take 
the coolant up to vessel outlet ports, and then through Ave parallel 
heat exchangers. Two 10,000-gal. demineralized water storage tanks 
on the ATR site are used to store primary system makeup water. 
Additional raw water storage exceeding 1,000,000 gal. is also avail- 
able for emergency addition. The secondary system cycles water at 
31,000 gpm from the heat exchangers to a six-bay cooling tower. To 
minimize auxumulation of solids in the secondary due to evaporar 
tion, water is continually purged and replaced. The make-up water, 
which constitutes almost 10 percent of the flow, is supplied from the 
600,000-gal. inventory in the cooling-tower cold well. 

Each of the nine irradiation positions in the core contains an 
independent pressurized water loop. These loops are used as test fa- 
cilities, and each is the responsibility of an operator who is not in the 
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reactor control room. The test facilities, the major reason for ATR's 
existence, are used primarily for testing naval reactor fuels and mate- 
rials. Each loop has its own shielded basement cubicle containing its 
own pumps, heat exchangers, pressurizer, and demineralizers. Alto- 
gether the loop support facilities occupy two basement floors around 
the reactor and below t .e control room. 

Other available test facilities include capsule irradiation thim- 
bles. There are 36 small thimbles, less than 1 in. in diameter, located 
in and around the core; these are used mainly for long-term irradia- 
tions of materials samples. Twenty other holes in the core, up to 5 
in. in dizoneter, are located outside the beryllium cylinders. Thirty- 
four additional spaces are available in two capsule irradiation tanks 
that hang on the outside of the c^re-reflector tank. There are also 
facilities for gamma irradiation in the fuel storage grid of the ATR 
storage canal. 

The ATR has a confinement system that is designed to withstand 
a pressure equivalent to 7.5 in. of water. It encloses the reactor 
and its control room, as well as the operations areas for the test 
facilities and the associated elevators and stairwells. The only way 
to vent confinement pressure is through the stack. Because the 
exhaust system has no filtering capability, the stack is designed 
to close if high radiation is detected in it. Although the primary 
system can be depressurized from outside the confinement to allow 
the low-pressure emergency coolant to be added to the system, there 
is limited capability to monitor post-accident conditions inside the 
confinement after evacuation. 

The original ATR design assumed a 20-year lifetime. Monitors 
are being used to gather data on the aging of all major reactor 
systems. Present practice is to replace the core internals of the 
reactor about every 8 years. There is a program underway to produce 
a plan aimed at extending the reactor's lifetime to 45 years. 

RECENT OPERATING HISTORY 

The ATR was in its 80th cycle of operation in April of 1988. 
(One cycle consists of the installation, burnup, and removal of a fuel 
loading.) The operating schedule and annual loadings of the reactor 
are determined by the classified test program developed by the Office 
of Naval Reactors. Operating cycles are typically either of 15-day 
or 35-day duration, and between runs the plant is shut down for a 
period of 4 to 7 days. In February 1989 the contractor plans to shut 
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the reactor down for 40 days to upgrade and replace the existing 
instnini<>nt panels in the control room. 

Since reactor start*up the most significant safety-related op- 
erating events at ATR have included unexpected cracking of the 
beryllium reflector, which led to a 3-month shutdown in 1972, and 
two overpressure incidents (in 1972 and 1977) in which design pres- 
sure limits were slightly exceeded. In addition, in 1986 a workman 
dropped foreign material into the reactor vessel that could not be re- 
covered. However, the event was not deemed to be significant enough 
to preclude continued safe operation. 

ATR has been continuoi :/ upgraded since 1969. Over 50 major 
modification projects have been undertaken at a total cost of $80 mil- 
lion (current dollars). The^^ projects have included upgrades to the 
plant protection system, emergency cooling water injection system, 
security system, simulator, control room, process instrumentation, 
fire protection system, seismic instrumentation, and experimental 
loops. The contractor has plans to undertake an additional 18 ma- 
jor modifications at a cost of $22 million during the FY 1989-1992 
period. 

TECHNICAL ISSUES 

Safety Analyses 

Conclusion: Modernization of safety analyses of the ATR 
reactor is well under way and generally on the right track. 
Efforts are aimed at improving understanding of severe acci- 
dent behavior, particularly in relation to limited core damage 
scenarios, and developing a risk-based management system 
to support future operation and management of the facility. 
These severe accident analyses are intricate, and so a full 
understanding of the relevant physical phenomena will not 
come easily. The potential threat to the confinement from 
accidents involving hydrogen generation is not yet adequately 
understood. 

Several activities are under way using modern techniques to 
improve the understemding of the ATR, including reevaluation of 
selected reactivity accidents and loss-of-coolant accidents (LOCAs), 
examination of severe accident behavior and potential threats to 
confinement, and execution of a PRA. These activities, as well as 
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normal operational safety and engineering reviews for the ATR, ben- 
efit significantly from the strong technical capabilities offered locally 
by EG&G Idaho's staff. 



Reactivity an^ Loss-of-Coolant Accidents 

Accident e%raIuations performed as part of the original design 
basis for ATR made the bounding assumption that certain acci- 
dents (e.g., large LOG As) resulted in 100 percent core melt [Phillips 
Petroleum c >., 1965a,b; Idaho Nuclear Corp., 1967]. Assuming 
a confinement leak r fce of 10 percent per day, projected doses at 
the site boundary were shown to be less than 10 CFR 100 lim- 
its. Accident analyses are currently being performed to evaluate 
more realistically the extent of core damage associated with poten- 
tial accidents at ATR. For example, early results of the analysis of a 
reactivity transient resulting from a hypothetical 2-in. br <Jc in one 
of the experiment loops show a peak power of 1,000 MW ^nd some 
core damage [EG&G Idaho, Inc., i986a]. In the case of LOG As, 
unpublished analyses by the contractor indicate thdt operation with 
a distribution of 30, 25, 25, and 20 MW in the four lobes of the core 
would be expected to produce fuel damage only in the high power 
lobe. However, a LOGA at power levels closor to ATR's 250-MW 
rated power, or with different power distributions, might damage the 
entire core. These examples indicate that further analyses are re- 
quired to better define the envelope of limited core damage accidents 
at ATR. 

Because the reactor has a high power density and the potential 
for experiencing flow instability [Aerojet Nuclear Go., 1975], its re- 
sponse to potential reactivity accidents and LOG As is sensitive to ^he 
specific ways in which power and coolant flow vary during transients. 
In the ATR, power and flow are coupled because of reactivi*;y feed- 
backs that derive from expansion of the fuel and the reactivity effects 
induced by the ATR experiment loops. Furthermore, because of the 
fuePs serpentine geometry and the a^^ymmetric distribution of power 
among the four lobes of the core, spatial effects would be expected to 
play a significant role in determining the course of accidents. These 
factors mean that modern analytical tools need to be applied with 
special care and in full knowledge of the limits of their applicabih',:. 
Provided that sufficient care is taken in applying these tools, tLcy 
can assist in developing a more defin live understanding of potential 
conditions that could lead to core damage in the ATR. 
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Severe Accident Behavior 

Severe accident analyses at ATR involve the examination of 
conduction cooling mechanisms and coolant flow through the narrow 
gaps that exist within the ATR fuel assemblies. Unpublished analyses 
described by the contractor to the committee in January 1988 do not 
appear to adequately consi^ x the potential expansion and distortion 
of overheated assemblies during severe accidents. Moreover, the 
analyses do not include sufficient consideration of the possibility 
that molten debris could relocate in the core; steam flow could move 
molten material upward inside the voided assembly channels. (This 
phenomenon is termed "flooding.") These criticisms of the ATR 
accident analyses servr to illustrate the difficulty of the effort and 
underscore the need for adequate resources, time, and peer review 
to achieve reliable analyses of severe accident behavior. They also 
highlight the need for explicit discussion in the contractor's PRA of 
how uncertainties have b^en treated. 

Potential Threats to the Confinement 

Potential accidents in the ATR that might result in molten fuel 
interacting with coolant would also benefit from thorough analy- 
sis and review. Data on fuel-coolant interaction are available from 
tests conducted in another reactor (SPERT), but they should be 
reviewed with care before being applied to ensure that the opera- 
tive parameters of the tests truly correspond to ATR characteristics. 
The analysis of potential molten fuel-coolant interactions in ATR 
should also include an up-to-date examination of vessel loading and 
fluid-structural material interaction problems. The contractor is now 
attempting to determine whether these latter considerations may be 
amenable to bounding analyses. 

The ex^.mination of fuel-coolant interactions and potential piping 
failures is also important in considering the potential for hydrogen 
generation, detonation, and combustion. While the ATR confine- 
ment is relatively voluminous, current analyses of potential accidents 
involving hydrogen generation are "nonmechanistic" [EG<kG Idaho, 
Inc., 1988k]. Thu**, analyses to date have assumed varying amounts 
of core melt, a si.'t^le melt temperature, and a single particle size to 
derive a "bounding*' hydrogen source term. Only diffusion has been 
considered in analyzh g hydrogen transport within the confinement. 
Condensation of st .am has not been included. A severe hydrogen 
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bum could conceivably produce confinement leak rates that signif- 
icantly exceed the 10 percent per day rate of confinement leakage 
that the contractor has shown will restrict releases to values below 
10 CFR 100 limits. In view of this, the committee believes that 
the examination of potential accidents involving hydrogen genera- 
tion should be considered a high priority. The contractor is planning 
to examine in greater detail such issues as potential hydrogen release 
rates, release locations, the extent of n^oural circulation and forced 
convective flow, and steam condensation. This examination should 
be comprehensive in scope in order to ensure that the analyses of the 
potential for hydrogen generation at ATR are credible. 

Probabilistic Risk Assessment 

Following the Chernobyl accident, the DOE luaho operations 
office formed a safety assessment review group to assess the available 
safety information on the ATR and to evaluate the need for any addi- 
tional analyses. This group recommended that a PRA be considered 
for the ATR [DOE, 1987]. EGkG recognized that a PRA could be 
used to enhance the operation of ATR in many different ways, and 
decided to undertake a complete Level 3 PRA. (EG&G has some 
experience in supporting probabilistic risk assessments for commer- 
cial reactors.) The contractor expects to use the PRA to develop a 
risk-based management system that will facilitate the following: 

• definition of the dominant accident sequences for the facility, 
including "external" events; 

• evaluations of the sensitivity of existing safety-related support 
systems; 

• evaluations of deficiencies in and potential interactions among 
safety-related systems; 

• evaluations of potential upgrades and modifications to im- 
prove the safety performance of the facility and establish a 
system for prioritizing proposed changes; 

• evaluations to improve human performance ii operations, 
maintenance, training, and the development of emergency 
procedures; 

• establishment of a basis for plant life extension; and 

• evaluations of new experiments or new modes of operation 
that could have a significant impact on the safety performance 
of the facility. 
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As indicated earlier in the report, independent peer review can help 
to ensure that accident analyses and PRAs are of the necessary high 
quality. To date there has been little external input to the ongoing 
severe accident analysis efforts. 

Recommendation: Severe accident analyses of potential hydrogen- 
related challenges to the ATR confinement should be given a high 
priority, and the contractor should explicitly address how analytical 
uncertainties have been treated in the ATR Level S PR A. DOE needs 
to provide adequate time and resources for the ATR accident analyses 
and PRA in order to ensure that they result in credible, high-quality 
assessments of plant risk. 



Experimental Loop Operations 

Conclusion: A reduction in the amount of water in the reac- 
tor's experimental loops results in an increase in the criticality 
of the reactor. Therefore, loss of water from and/or depres- 
surization of one or more of the experimental loops can result 
in a reactivity transient, potentially resulting in extensive 
core damage This situation calls for particularly vigorous 
attention to the safe operation of the experimental loops. 
Well-written procedures and well-qualified and supervised ex- 
perimental loop operators a^e required to prevent reactivity 
accidents. 

The close neutronic coupling of ibe experimental loops with the 
ATR reactor means that improper opei-ation of experiments can 
have an impact on reactor safety. This accentuates the importance 
of ensuring adequate qualification »ind supervision of the personnel 
who operate the loops. During the committee's visit to the ATR, 
however, the experiment operators on a particular shift had very lit- 
tle experience. Moreover, subsequently obtained reports of unusual 
occurrences at ATR revealed errors in the operation of the experi- 
mental loops — at least one of these incidents, had it occurred during 
power operation, could have significantly affected the reactivity of 
the reactor. These facts highlight the need to ensure that experi- 
enced experiment operator's are on duty during every shift, as well 
as the need for closer management audits, root-cause analyses, and 
periodic retraining of experiment i aerators. The latter is especially 
important after unusual occurrences in which loop operators have 
been involved. The need for careful supervision of loop operations 
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may become even more immediate a problem as more experienced 
operators leave (through retirement or for other reasons) and greater 
reliance must be pl£u:ed on newly qualified personnel. 

Recommendation: The existing training program for experiment op- 
erators should be strengthened on the basis of a careful review of 
operating experience on the experimental loops. The training program 
should include emphasis on corrective actions in response to unusual 
occurrences in order to ensure that procedures for loop operations are 
clear and up-to-date. Management should also attempt to ensure that 
there are experienced operators in the experimental loop area on each 



shift. 
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Experimental Breeder Reactor II (EBR-II) 



The Experimental Breeder Reactor I! (EBR-II) is a sodium- 
cooled fast reactor with thermal power of 62.5 MW, It is operated by 
•^he Argonne National Laboratory (ANL) and is located on the ANL- 
"West site at the Idaho National Engineering Laboratory (INEL). 
EBR-II is the only test and research reactor that also generates 
electricity, supplying 14 to 15 MW electrical output for the INEL 
grid. Steam from EBR-II is also used to heat the ANL- West facilities. 
At start-up in 1964 the mission of the reactor was to prove the 
feasibility of a metal-fueled liquid metal-cooled reactor (LMR) in 
a breeder cycle. Within a few years the equivalent of five cores of 
fuel was cycled from the reactor through an adjoining reprocessing 
facility and back to the reactor. 

In 1968-1969, the reactor was converted to a fast-reactor irra- 
diation test facility. Fuels and materials that are to be irradiated 
in EBR-II are placed in core subassemblies essentially identical to 
the subassemblies holding the driver fuel elements. An EBR-II sub- 
assembly is a long hexagonal tube about 2.3 in. across. The reactor 
core region consists of 127 subassemblies standing in a hexagonal 
array. Driver fuel is in approximately 57 of them, and control and 
safety rods use up another 11. The remaining 59 are free to hold 
specimens for irradiation. The subassemblies for irradiation tests are 
carefully located in the core; many can hold up to 91 specimens. 
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The EBR-II fast neutron flux ranges from 2.3 x 10^^ 
neutrons/cm^ /s at the core center to 0.9 x 10^^ neutrons/cm^/s 
at the core outer periphery. (Fast neutrons are defined as those with 
kinetic energy above 0.111 MeV.) Mean neutron energy at the core 
center is about 0.4 MeV. 

More recently, the EBR-II has been utilized to support the base 
technology program for developing small LMRs. Hence, the two 
main purposes of EBR-II are (1) demonstration of the inherent safety 
and shutdown heat removed capability of the LMR concept, and (2) 
irradiation of fuels and materials. As of May 1988, the staffing level 
was 253. The annual operating budget has been approximately $25 
million in FY 1985, 1986, and 1987. 

EBR-II is the only pool reactor of the five research reactors con- 
sidered in this report. In an LMR pool reactor, the core, reflector, 
blanket, neutron shield, primary pumps, primary piping, interme- 
diate heat exchanger, and in-vessel fuel handling equipment are all 
submerged under the molten sodium of the primary system. The 
primary system is cooled at the intermediate heat exchanger, which 
transfers heat to sodium in the secondary system. The secondary sys- 
tem eventually transfers heat to water and saturated steam in modu- 
lar evaporators and superheaters, producing superheated ste2an that 
drives the turbine-generator -nd produces electricity for the INEL 
grid. 

The EBR-II reactor has a number of ?.tt '•active passive safety 
characteristics. Because of the pool and guard vessel surrounding 
the reactor vessel, the likelihood of LOCAs at EBR-II is extremely 
remote. A decrease in sodium density in EBR-II (such as from 
boiling) results in a more stable reactivity response than in larger 
sodium-cooled reactors. Analyses by the contrEu:tor demonstrate that 
if a gas or vapor bubble, with dimensions the width of an assembly or 
greater, were introduced into the sodium at the most adverse location 
in the core, it would produce a negative reactivity effect, tending to 
shut the reactor down. Because of the favorable reactivity behavior 
of the design, and the large margin between operating temperatures 
and fuel failure that is associated with the use of EBR*II metal fuels 
(Mark II U-Fs fuel with type 31 stainless steel cladding znd Mark III 
U-Zr fuel with Type D-9 stainless steel claddmg), the reactor is able 
to respond to loss-of-flow and loss-of-heat-removal transients without 
fuel damage, even without scramming the reactor. (Indeed, this facet 
of the design hza been demonstrated in tests.) A natural-convection 
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driven, heat-removal system is capable of rejecting decay heat from 
the plant without electric power. 

The likelihood of an accident progressing to severe damage of 
the Mark II or Mark III fuel in EBR-II appears to be quite small 
because of the plant's passive safety characteristics. Collapse of 
the entire core during an accident and its subsequent reassembly 
in a uniform mass of molten fuel, as is assumed for the purpose of 
analyzing a hypothetical core disruptive accident in EBR-II, is an 
even more remote possibility. Moreover, energy absorbing structures 
have been provided around the vessel to contain the energy release 
in an accident of this type. EBR-II also has a containment building 
that provides added assurance that a large release of radioactivity 
to the environment can be prevented, provided that the building is 
sealed (i.e., "isolated") upon the initiation of an accident (see below). 

EBR-II is now used to develop and demonstrate advanced metal- 
lic fuels, a key element of ANL's integral fast reactor program. (In 
fact, unlike FFTF, it has never used an oxide fuel as the driver fuel, 
although oxide fuels have been irradiated in it in the past.) In the 
reactor's early years, reloads of driver fuel came from reprocessed 
EBR-II spent fuel elements. After the processing facility was shut 
down in 1969, EBR-II used a fuel fabricated to mimic the product 
of the processing facility. The fuel was 95 percent uranium and 5 
percent "fissium." The uranium in this admixture was enriched to 
67 percent U-235. The fissium was roughly equal parts molybdenum 
and ruthenium, with small concentrations of rhodium, palladium, 
zirconium, and niobium. (The advantage of using surh alloys is that 
they exhibit less swelling than unalloyed urani m.) The fuel pins 
contain sodium in the gap between the fuel slug and the cladding to 
transfer heat efficiently to the cladding. The cladding gap accommo- 
dates swelling of the fuel during irradiation. 

More recently, EBR-II has been loaded with so-called binary 
metal fuels composed of uranium and zirconium. These fuels are 
more economical to fabricate than Bssium fuels, and they can operate 
at higher temperatures and to greater burnup. Tests are now being 
conducted on more advanced, ternary metal fuels that are composed 
of uranium, plutonium, and zirconium. 

The EBR-II staff recently undertook a review of plant aging to 
identify mechanisms that could potentially interfere with the con- 
tinued operation of the plant. A number of potential problems 
were identified, including the possibility of sodium penetrating and 
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swelling graphite*filled canisters located in the reactor head and ther- 
mal shield. None of the problems that were identified appeared in- 
surmountable. The EBR-Il plant life extension study is an excellent 
example of how to avoid future problems by systematic examination 
and proper planning. Similar studies at the other Class A reactors 
might provide similar benefits. 

In January 1988, DOE announced that it was rescinding plans 
to shut the reactor down in 1993. The present plan calls for EBR- 
n to continue operation into the 199Cs, completing the current fuel 
development program, demonstrating on-site fuel recycling, conduct- 
ing further tests of passive safety using metal fuels, and irrauliating 
materials for the space reactors program. 

RECENT OPERATING HISTORY 

EBR-II nominally operates on a 10-week cycle. Ten full-power 
weeks are followed by a 1-week turnaround time for refueling and 
minor plant maintenance. The downtime is also used for discharging 
and replacing irradiation samples. In addition, the plant is shut 
down for 4 to 6 weeks each year for more comprehensive modification, 
maintenance, and inspection. 

The operating schedule calls for the plant to be available for 
operation approximately 80 percent of the time. The actual eu:hieved 
cap2u:ity factor has climbed steadily in the last 5 years, from 67 
percent in 1983 to 81.3 percent in 1987. 

EBR-II registered 43 unusual occurrence reports (UORs) in the 
last 5 years (1983-87). There is no single major problem causing the 
UORs, although the general area of primary sodium flow control is 
a frequent contributor. Four of the UORs were caused by problems 
with primary flow indicators in the plenum. Several others involved 
reactor trips from momentary or spurious primary flow indications. 
Another general cause of UORs seems to be the jamming of moving 
parts owing to sodium/sodium oxide buildup. This has been respon- 
sible for two cases of shaft binding on a primary pump. (During 
the 1988 annual maintenance shutdown, the pump experiencing this 
problem was refurbished.) 

There have been 15 major modifications to the EBR-II plant since 
startup in 1964. These have included modifications to such major 
systems as the EBR-II fuel elements, fuel and reflector subassemblies, 
contiol rods, and shutdown coolers for the primary coolant system. 
Four additional major modifications are planned. One is a change of 
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the fuel composition and fuel-element cistdding; another is a change 
in subassembly design to accommodate fuel burnup to 20 percent; 
the third involves installation of a developmental delayed neutron 
detection system for a joint DOE/Japanese program of oxide fuel 
performance testing; and the fourth is the implementation of an 
automatic plant start-up capability using digital-computer control 
equipment. 



Conclusion: Quality assurance responsibilities at EBR-II are 
mixed with the operations function, rather than being sepa- 
rated in an independent organization. 

The benefits of providing a separate management chain for qual- 
ity assurance are generally accepted elsewhere in the DOE system. 
Such a structure can facilitate safety by providing oversight of line 
operations personnel. EBR-II does not have a management structure 
with an independent quality assurance group with a safety mission 
separate from experimental and operational goals. 

Recommendation: The contractor should examine whether to reor- 
ganize to strengthen the safety and quality assurance functions at 



Conclusion: There are currently no plans to perform even a 
Level 1 PR A for the EBR-II plant. 

In Part A, the committee recommended that, at the least, a 
Level 1 PRA should be undertaken for each Class A reactor. Al- 
though the EBR-II plant has & number of attractive passive safety 
feature? that serve to reduce the risk from loss-of-coolant and cer- 
tain transient-initiated accidents, a PRA could nonetheless provide 
important insights. For example, the operating contractor needs an 
understanding of the features of the plant that have the greatest 
safety significance in order to ensure that resources applied to mod- 
ifying the plant are properly allocated. In performing a PRA for 
EBR-II, the following should be carefully evaluated: 



TECHNICAL ISSUES 



Organizational Structure 



EBR-II. 



Probabilistic Risk Assessment 
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• The risk of refueling accidents. Because much of the refueling 
activity at EBR-II occurs under sodium, the operators can- 
cot observe what is happening. A number of incidents and 
proolems have occurred during the refueling process, includ- 
ing dropped subassemblies and a hydrogen explosion in the 
interbuilding coflSn (a structure for transporting irradiated 
assemblies out cf the containment). 

• The reliability of the reactor control systems. There is a 
history of control rods sticking at EBR-II. A second control 
system, the jafety-rod system, is primarily for use during fuel 
handling, when the c ::trol rods are removed. The relis' llity 
of the control systems that provide reactor protection should 
l e examined both for normal operation and during refueling 
operations. 

• The reliability of containment isolation. The reactor operates 
in a purge mode in which air is drawn into the containment 
by the ventilation t stem, provides cooling to the instrument 
thimbles and to the reaciior shield, and after filtering is re- 
leased to the discharge stack. In the event of an accident, 
valves would have to be closed to achieve isolation. 

Recommendation: The committee recommends that a Level 1 PRA be 
performed for *he EBR-II plant and that refueling accidents and the 
reliability oftKe reactor protection system and containment isolation 
6t carefvily (zamined in the context of the PRA. 



Acoustic Monitoring 

Conclusion: The EBR-II reactor has acoustic monitoring 
eqt'.ipment installed to monitor vibrations in pumps and com- 
ponents, but th' lystem is not currently in use. 

The analysis of acoustic signals is used at nuclear power plants 
to identify incipient safety problems, such as vibrations in pumps, 
crack initiation, leakage, loose parts, vibrating core .nternals, and 
flow Vi ,ckage. Loose-part monitors, for exami. a, are required for 
comm^^oial nuclear power plants. Although acoustic monitoring 
equipment was installed in EBR-II in conjunction with an earlier 
program to develop a » ibration-monitoring capability, tl staff fa- 
miliar witli the ec ^ipment are no longer employed at EBR-II, and 
the equipment k not being used. 
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Recommendation: The contractor should survey the use of acoustic 
monitoring systems at other reactors to determine the best v<?€ of the 
system currently installed in EBR-II or whether installation of an 
alternative system would have aafHy benefits. 
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Fast Flux Test T^acility (FFTF) 



The Fast Flux Test Facility (FFTF) is a 400-MWt liquid metal 
reactor (LMR). It is located at the Hanford Nuclear Reservation near 
Richland, Washington. Since its start-up in 1980, FFTF has been 
•operated by Westinghouse Hanford Company (WHC). WHC also 
operated the Hanford Engineering Dc lopment Laboratory until 
June 1987, w!;en DOE consolidated its contracts for operation of 
the various nujlear facilities at Hanford— including FFTF, the N 
Reactor, and the Purex Chemical Processing Plant— under WHC. 

The primary mission of the FFTF has been the irradiation of 
materials and reactor fuels. A number of natural circulation cooling 
tests have also been performed, and the contractor plans to use the 
reactor to further investigate the passive safety features of LMRs. In 
FY 1988 the operating budget of the reactor was $41 million and the 
staff numbered about 375. 

To date, FFTF has relied almost exclusively on oxide fuels, 
although a metal fuel assembly was inserted in the reactor beginning 
in 1986 as an initial experiment to evaluate the FFTF metal fuel 
concept. Conversion to a full metal core is scheduled to be completed 
by 1992. The oxide fuels currently in use are mixtures of PuOa.and 
UO2, with both natural and depleted u-anium. The percentage 
of PUO2 ranges from 22.5 percent to 29.3 percent in FFTF fuel 
assemblies. The plutonium is 88 percent Pu-239, with less than 1 
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percent Pu-241 and the remamder Pu-240. The total weight of fissile 
material in a 74-element FFTF core is about 560 kg, approximately 
21 percent of the total oxide fuel weight. 

The total neutron flux at FFTF ranges from 7 x JO^^ 
neutrons/cm^ /s at the center of the core to 4 x 10^^ neutrons/cm^/s 
at the periphery. The mean kinetic energy of the neutrons is 0.2 
MeV; 65 percent of the flux has kinetic energy above 0.1 MeV. The 
planned conversion to metal fuel will decrease the flux somewhat and 
increase the mean kinetic energy of the neutrons. 

The reactor core consists of 91 twelve-foot long hexagonal tubes, 
or assemblies, standing vertically in a hexagonal array. Each as- 
sembly consists of a hexagonal flow duct surrounding an internal 
structure. Most of these assemblies contain fuel pins; in a typical 
core loading, 74 of the 91 are used to hold driver fuel pins. Of the 
remaining 17 assemblies, 3 are safety jds, 6 are control rods, and 
8 are reserved for a variety of irradiation tests. The hexagonal as- 
semblies are each 4.6 in. across and 12 ft long, giving the total array 
a diameter of 4 ft. The reactor fuel is contained in a 3-ft section of 
the pin, providing the FFTF with a core that is 3 ft in height by 
4 ft in diameter. The 8 assembly positions available for irradiation 
testing can be instrumented with electrical and pneumatic leads that 
penetrate the reactor head. 

The FFTF cooling system has three primary loops that circulate 
liquid sodium through the reactor vessel. (Only one loop is needed for 
adequate core cooling; three loops provide redundancy and greater 
assurance of the cooling function.) Each loop has its own pump, heat 
exchanger, and secondary loop; only the reactor vessel is common to 
all three. There are 128,000 gal. of sodium in the primary system, 
flowing at 43,500 gpm. The temperature in the reactor vessel rises 
from 680'' F at the core inlet to 938**F at the outlet. Each primary loop 
exchanges heat generated in the core with an independent secondary 
loop. Each of the secondeiry loops has its own pumps, and each 
has 4 air-blast (or "dump") heat exchangers. The FFTF design was 
reviewed by the NRC staff prior to resu^tor start-up. 

A series of te«ts conducted in July 1986 demonstrated a degrer of 
passive safety with a modified FFTF core. The test series culminated 
in a test in which, with the reactor operating at 50 percent power, 
all the coolant pumps were shut down in order to evaluate the core's 
response to a simulated loss of electric, power to the pumps. These 
tests were conducted without scramming the reactor and without 
operator intervention. For the purposes of the tests, 9 of the Inconel 
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reflectors immediately outside the core were replaced with so-called 
gas expansion modules (GEMs). A GEM is essentially an inverted 
test tube with argon gas compressed at the top. With the pumps 
operating and providing full flow, a standing column of sodium is 
maintsuned in the bottom of the tube. The column of sodium keeps 
the argon compressed at the top of the tube and serves as a neutron 
reflector. When the pumps stop, such as during the loss-of-flow tests, 
the pressure drops, the argon expands, and the sodium is driven dovm 
and out of the tube. This effectively removes the reflector, allowing 
more neutrons to escape the core, adding negative reactivity and 
thereby tending to shut the reactor down. The need for such a large 
negative reactivity msertion to ensure safe shutdown upon loss of flow 
conditions results mainly from the need when usmg oxide fuels for a 
very rapid decrease in power (and coolant temperature) to prevent 
sodium boiling. 

In conducting these tests, the contractor was limited by the fact 
that the temperature sensors in FFTF are located 5 ft above the 
fuel. Under natural circulation conditions (but not under forced flow 
conditions), the coolant takes a few seconds to flow from the fuel 
to vhe sensors, causing a time delay in the resuiout of core temper- 
ature. A safety limit of 1,074*^ was set as the maximum allowable 
temperature at the sensors. In a test at 50 percent power and 100 
percent flow, the maximum temperature measured was 950** F at 100 
s, and was fallmg past 750** F at 400 s. Computer models indicate 
that without GEMs a similar core temperature would be reached in a 
loss-of-flow test starting from 5 to 10 percent of full power, and that 
the sodium in the primary system would approach boiling if the test 
were started from 35 percent of full power. The GEMs were inserted 
in the reactor only for the few weeks during which the loss-of-flow 
tests were conducted; that particular core configuration was never 
taiken to full power. 

There is no separate backup heat removal system at FFTF. 
Tests in 1980 established that the FFTF design affords sufficient 
natural convection heat removal capability to assure core cooling for 
all accidents analyzed in the safety analysis for the facility. 

FFTF has plans to shift from oxide fuels to a "binary" metal fuel 
The new binary metal fuel will consist of 90 percent uranium (with 
enrichments in the range of 26.5 to 33.8 weight percent) together with 
10 percent zirconium. The cladding material will also be changed, 
from 316 stainless steel to HT-9 ferritic-martensitic alloy, a material 
that promises to solve the problem of radiation-induced swelling 
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that has been experienced in assembly ducts and fuel cladding used 
in EBR-n. The core restramt built into FFTP for use with oxide 
fuels will inhibit radial expansion of the metal fuel, thus reducing the 
negative reactivity provided by expansion of the fuel assemblies, so 
the regular use of GEMs is under consideration. 

The addition of a privately financed power generating capability 
at FFTF (referred to as a "power addition") is under study. The 
proposed power addition includes use of steam generators formerly 
designated for the now defunct Clinch River Breeder Reactor project. 
Use of two of the secondsury loops at FFTF for power generation could 
yield about 110 MWe. 



RECENT OPERATING HISTORY 

FFTF began full-power operation in April 1982. As of this 
writing, it is in its 10th cycle of operations. Early operating cycles 
were devoted to characterization of the behavior of the mixed-oxide 
driver fuel and to test irradiations of LMR materials, components, 
and assemblies. 

As discussed above, the reactor was subjected to a series of 
transient tests during cycle 8 (February to July 1986) to investigate 
passive safety feature:? of the reactor's design. Beginning with cycle 
9, an extensive large pin mixed oxide fuel test program was begun. 
In late 1986, metal fuel testing was also initiated in preparation for 
conversion to metal fuel. 

Since 1983 the reactor has had an improving capacity factoi, 
averaging fewer than three unplanned scrams per year. There has 
been only one unplanned scra*n or forced outage since June 1986; 
the reactor operated for 18 consecutive months from July 1986 to 
January 1988 with none at all. 

The number of plant modifications that were at some stage of 
completion at FFTF averaged about 325 throughout 1987, but was 
down slightly during the first quarter of 1988. From the beginning of 
full-power operations, there had been a history of increasing cesium 
activity in the primary sodium coolant owing to cladding and fuel pin 
failures associated with experimental irradiations conducted at the 
facility. However, recent installation of a cesium trap appears to have 
brought the problem under control. At times, the backlog of correc- 
tive maintenance items has been extraordinarily large (1,149 items 
in February 1987), but this backlog was steadily reduced during 1987 
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until the number of outstanding requests for corrective maintenance 
stood at 496 at the end of March 1988. 

Examination of unusual occurrence reports suggests that the 
greatest problems are associated with operation of the in-vessel han- 
dling machine, the bottom loading transfer cask, the zero time outage 
equipment (equipment for automatically transferring essential safety 
systems to DC batteries during loss of offsite power), and various 
remote handling and cooling equipment within the interim exami- 
nation aiid maintenance cell. The latter happens to be the tallest 
hot cell in the nation. The most significant safety-related operating 
events include the following: 

• In May 1982 an error was made in a computer program asso- 
ciated with operation of the in- vessel handling machine. The 
program misidentified a position in the core that was sched- 
uled for refueling. This resulted in the inadvertent withdrawal 
during refueling of a control rod rather than an experimen- 
tal test assembly. No criticality occurred, and the event was 
within the design basis of the plant. 

• In June 1982, with the reactor shutdown, a primary system 
pump running on a pony motor seized up because of the 
buildup of sodium or sodium compound deposits on the pump 
shaft. 

• In November 1984 cavitation-induced erosion of a duct on 
an electromagnetic pump, caused by operating the pump at 
excessive flow rates, led to a sodium leak. 

• In October 1985 a bottle of helium used to cool specimens 
within a materials open test assembly was inadvertently re- 
placed with a bottle of argon, causing overheating and dam- 
age to some of the specimens. 

Although FFTF has a reactor simulator on site, the existing one 
is recognized as having limited capability. Westinghouse Hanford 
plans to request additional capital equipment funds during FY 1988- 
1990 to upgrade the FFTF simulator. Other planned modifications 
include the power addition; upgrades to the fire detection system; 
in-containment equipment for dealing with by-product tritium that 
would accompany future insertion of a fusion materials open test 
assembly into the core; back-up power for the zero time outage (ZTO) 
busses to permit repairs to the ZTO while the reactor is operating; 
and additional upgrades to various fuel handling equipment. 
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TECHNICAL ISSUES 
Conversion from Oxide to Metal Fael 

Conclusion: The projected conversion of FFTF from mixed 
oxide fuel to metal fuel presents a number of safety issues 
that are only partially resolved. Resolution of these issues 
wUl require intense analytical and experimental effort, and 
the existing schedule for completing them is very demanding. 

Because DOE intends to withdraw funding for additional fab- 
rication of oxide fuel, uninterrupted full-power operation of FFTF 
beyond 1991 will require conversion from oxide fuel to a new metal 
fuel. The DOE objective in converting to metal fuel is to provide 
continued support for the nation's LMR development pv^ gram. 

Planning for the conversion of FFTF to metal fuel entails con- 
siderable analytical and experimental research, and an intensive pro- 
gram is under way. The analytical program includes design and safety 
evaluation of the core, fuel assemblies, and pins, while the experi- 
mental work (in progress and planned) incluaes pin tests, prototype 
assembly tests, and qualification tests in the reactor. The final design 
will depend heavily on the results of a core demonstration experiment 
that will be discharged from the reactor in early 1991. At that time 
there will be about 25 metal fuel assemblies in the FFTF core — a 
limit that derives from current test procedures and that cannot be 
exceeded without formal approval of au addendum to the final ssifety 
analysis report (FSAR) for the facility [WHC, 1977 as amended]. 

The metal fuel under consideration will not be greatly different 
from fuel currently being used in EBR-II, for which there is a growing 
body of test data and operational experience. Moreover, the FFTF 
metal core is expected to have steady-state mechanical and thermal- 
hydraulic properties that are similar to the present FFTF oxide core. 
But there are a number of significant differences between the FFTF 
metal and oxide cores. Lifetime fuel pin performance will not be 
the same, several reactivity effects will be significantly different, and 
roactor transient behavior will be modified. 

The different reactivity effects will be caused mainly by the 
harder neutron spectrum (higher average neutron energy) with metal 
fuel. The harder spectrum will result in a smaller change in reactiv- 
ity with fuel burnup, higher neutron leakage from the core, reduced 
control rod effectiveness, reduced negative Doppler feedback, and 
increased positive sodium void feedback. Moreover, the change from 
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fissile plutonium to fissile uranium yields more delayed neutrons, 
which means that the kinetic sensitivity of the core to reactivity 
changes will be lower. (The reactor's response rate directly depends 
upon the ratio of the control chjuige to the fraction of neutrons 
that are delayed. As this ratio is reduced, the reactor is slower to 
respond to control changes.) All these effects will have impacts on 
both transient and steady-state reactor operation. 

The FFTF staff has identified five areas of "technical challenge'' 
that require special attention in planning the fuel conversion [WHC, 
1988a]. Some of these are more directly relevant to safety than others. 

First, postulated accidents involving loss of flow without scram 
(LOFWOS) could yield some sodium boiling and fuel damage with 
the new fuel. The contractor's analysis suggests that adverse impacts 
can be mitigated by the use of GEMs, which are designed to introduce 
negative reactivity automatically during flow coastdown [see, e.g., 
WHC, 1988a, 1988g-i, 19881]. However, the contractor believes it 
may be necessary to restrict the normal operating power level of 
the reactor in order to obtain an adequate margin of safety between 
the predicted maximum temperature of the sodium coolant and the 
sodium boiling temperature. An alternative under consideration is 
to modify the structural design of the core to permit greater thermal 
expansion during transients. 

Second, another category of accidents could also produce some 
sodium boiling and fuel damage. These are known as transient over- 
power without scram (TOPWOS) accidents, and involve an addition 
of reactivity while the reactor is operating at nominal full power. The 
reactivity addition, which might be the result of the withdrawal of 
a control rod or the consequence of a seismic event, causes power to 
increase above 100 percent. The scram function on increasing power 
is then assumed to fail. Hence, power continues to increase, resulting 
in a mismatch between reactor power and coolant flow, leading to 
sodium boiling and fuel damage. 

The GEM system would not be helpful in this case because 
coolant flow would continue during such an accident. Restriction 
of the operating power level of FFTF, as well as structural design 
changes, may be necessary to mitigate the potential effects of tran- 
sient over-power events. 

It is not yet clear which of these two classes of accidents (LOF- 
WOS or TOPWOS) represents the worst case for determining design 
limits, though the GEM system is thought to render loss-of-flow acci- 
dents relatively harmless. Analysis is continuing, and transient tests 
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of fuel pins in the Transient Reactor Test (TREAT) facility in Idaho 
will be very important in verifying fuel performance during potential 
FFTF transients. 

Third, axial growth of metal fuel pins may limit the degree 
of burnup (maximum exposure in the reactor) that metal fuels can 
achieve in FFTF. Recent data from EBRrll suggest that at 10 percent 
burnup elongation of the fuel column may be somewhat larger in 
FFTF than was originally projected [WHC,.1988gl. 

Fourth, there may be an incompatibility between the new fuel 
and new cladding materials, which could provide a potential source 
of fuel failure during transients. The eutectic temperature (i.e., the 
temperature at which the fuel begins to attack the cladding material 
in which it is encased) for HT9 clad metal fuel was only recently 
found to be 725°C. The contractor believes that there is sufficient ev- 
idence to demonstrate that cladding penetration at this temperature 
would be very slow. Furthermore, while the rate of penetration in- 
creases exponentially above the eutectic temperature, the contractor 
believes that there are a range of reactivity management measures 
(e.g., use of GEMs, limits on operating cycle length, or use of fixed 
burnable shims) that can be instituted to preclude reaching fuel 
temperatures during an accident that would result in cladding pene- 
tration. However, Argonne has unconfirmed data that indicate that 
the eutectic temperature may actually be 700° F (ANL, 1988). Fur- 
ther experiments and analysis are necessary to establish the eutectic 
temperature and thus to determine whether there is a need to impose 
new limits on reactor operation in order to account for this effect. 

Finally, there is some evidence of strain in metal fuel pins re- 
moved from EBR-II that appears to be the result of trapped fission 
gas [WHC, 1988g]. This raises the possibility of fuel deformation or 
cladding failure after prolonged exposure. If confirmed, this effect 
would limit the expected lifetime of the new metal fuel. 

Recommendation: Adequate resources and realistic schedules for art' 
alytical and experimental work must be established to resolve safety 
issues in support of the conversion of FFTF to metal fuel. 

Approval of an addendum to the FSAR, covering operation of 
FFTF with metal fuel, should be contingent on in-depth reviews by 
the contractor's Safety Review Committee and the recently formed 
DOE Advisory Committee on Nuclear Facility Safety. 
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Gas Expansion Modnlos (Gfilvls) 

Conclubxon: GEMa were demonstrated to be effective safety 
devices in loss-of-flow tests coMucted at reduced power (50 
percent or less) in the FFTF oxide core. They may provide a 
large margin against sodium boiling for loss-of-flow accidents 
in a mttal core, but there are some aspects of GEM behavior 
that need to be carefully analyzed, GEMa will not be helpful in 
potential transient over-power accidents in which full sodium 
flow continues. 

The FFTF contractor has deinonstrated that some measure of 
protection can be obtained against accidents involving T^OFWOS by 
using the GE^L described above. Tests in 1986 shov.ed that after 
shutting off the pumps with the reactor at 50 percent power, 90 
percent oi the negative reactivity effect of n^-« OEMs in the oxide 
core was effective within 20 s [see, e.g., WnC, 1987g]. (The test 
could not be conducted at higher power levels with the oxide fuel, 
because under certain hypothetical conditions boiling could occur.) 
With metal fuel, the contractor expects the OEMs to provide a 
significant reduction in reactivity during the most cr J phase of 
an unprotected loss-of-flow event, and thereby to ensure that peak 
sodium temperatures are maintained well below boiling. 

The safety of full-power operation with OEMs m the core needs 
careful analysis and review before OEMs are inserted for routine 
operation with metal fuels. If sodium flow were suddenly restored 
during a loss-of-flow event, the GEMs could conceivably cause a 
reactivity increase and a possible power overshoot. This possibir..y 
deserves careful analysis '^y the contractor. 

Recommendation: The contractor should perform improved computer 
simulations of GEM behavior in loss-of-flow and other potential tran- 
sient events, and sho' Jd examine the possibility of unexpected reactiv- 
ity additions associa <d with use of GEMs before reinserting GEMs 
in the reactor. 

Severe Accident Analyses 

Conclusion: Severe accidents in /FTFhave not been assessed 
using state-oj-the-art methods developed since the reactor 
began operation. Uncertainties in post- accident heat removal, 
in the evolution of fission products from molten core debris 



ERLC 



83 



68 



(radioactive source term), in energetic core disassembly, and 
ir containment integrity need to be reexamined using up- 
to-dat^ methods f *hat better estimates of the radiological 
consequence? of severe accidents ran be made. 

The committee has reviewed aspects cf the original safety review 
for FFTF in order to understand the role that severe accident analysis 
will play in the development of an addendum to the FSAR for metal 
fuel. The original safet" analyses for FFTF were all based on oxide 
fuel. 

The FFTF contractor takes the view that a core disassembly 
accident is essentially impossible, because no reasonable scenario 
leading to such an accident has been found. Nevertheless, to be 
"conservative," a severe accident was analyzed in the FSAR by as- 
suming such an accident and by assuming worst cases (e.g., all of 
the heat was assumed to be transferred to the FFTF concrete) for 
the events that would follow. The result was a hypothetical accident 
producing a maximum kinetic energy estimated at 150 MJ. It was 
judged that the reactor vessel and external coolant system could 
withstand an accident of this magnitude. 

The NRC staff concurred in the contractor's assessment, but 
raised questions about the cooliibility of molten core debris [NRC, 
1978, 1979; DOE, 1987; WHC, 1981]. In particular, the staff ar- 
gued that hydrogen explosions or long-term pressurization during a 
worsn-case accident might result in containment rupture Thre3 ma- 
jor recommendations were m^de. These concerned (1) availability 
of decay heat remo* ' hy natural circulation, (2) improvement of 
containment margins, ana (3) assurance of piping integrity. 

The first reconunendation wis saUsfied by the contractor by 
demonstrating the establishment of natural circulation cooling in 
ppipp^ The second recommendation resulted in the installation of a 
majcr system for filtered venting of the containment in the event of 
a severe accident. And the third recommendation, wh'ih concerned 
piping integrity, led to programs and systems for ultrasonic td^.ting, 
sodium leak detection, and materials surveillance. Certain aspects 
of ultrasonic testing were ultimately dro d as impractical, but the 
remaining recommendations w ;re carried uut. 

Meanwhile, more advanced methods for severe ^'^cident analysis 
were under development elsewhere. In particular, advanced methods 
of severe accident analysis for LMRs were developed in conjun^ on 
with safety analyses for the Chnch River Breeder Reactor project. 
Such phenomena as aerosol generation and radionuclide re^'^ se rates. 



84 



69 



which are important for filter venting strategies at FFTF, were ex- 
tensively examined for the Clinch River reactor. Moreover, since 
the completion of the FFTF safety analysis, the light- water reactor 
safety community has developed more sophisticated methods for un- 
derstEUiding the penetration of steel by core debris and the intricacies 
of hydrogen combustion. Even though these methods have yet to be 
applied to FFTF, the FFTF contractor has told the committee that 
it has no plans to conduct a probabilistic risk assessment of FFTF. 

It may be possible t^^ establish that a core disruptive accident is 
a low probability event at FFTF because of the core design and be- 
cause aloss-of-heat-sink accident at FFTF is sufficiently improbable. 
Suca analyses have been performed, for example, for advanced LMRs 
that are currently being designed under DOE contract. Nonetheless, 
a Level 2 PRA would enable the contractor to compute the prob- 
abilities of events leading to loss of coolable geometry in the core 
and potential failures to contziinment that might result from core 
disruptive accidents. 

Recommendation: The FFTF contractor should use state-of-the-art 
analytical methods to examine the possible evolution of loss-of-flow or 
transient over-power events into energetic core disruptive accidents, 
for cores containing partial or full loadings of metal fuel. The con- 
tractor should undertake a Level 2 PRA to assess the risks associated 
with these events. Severe accidents should be investigated using the 
latest information about debris coolability, steel and concrete penetra- 
tion rates, radioactive source terms, and the potential for containment 
pressurization. 

FFTF Power Addition 

Conclusion: The power addition under consideration at 
FFTF poses a number of safety issues that are not considered 
in the current FSAR and its updates. Although a ^safety 
assessment'^ of the power addition has been publish?d, it has 
received limited technical review and does not fully resolve a 
number of questions. 

In supp^^rt of the conceptual design and technical feasibility 
studies for a power addition at FFTF, the contractor has prepared a 
"safety assessment" document [WHO, 1987s). The document aims to 
address the impact of the proposed power addition on existing safety 
analyses and the variety of new potential accidents that v/ould be 
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created by the power addition. The latter include an increased poten- 
tial for sodium-water reactions, steam line breaks, loss-of-feedwater 
accidents, overcooling and undercooling events, and the effect of 
some "external" events, such as tornados and earthquakes, on the 
reconfigured plant. 

The committee believes there are a number of aspects to the 
proposal that require careful analysis and review. These include the 
proposed mode of operation with dual control rooms, control room 
habitabiiity in the event of a sodium fire, potential nonuniformity 
of flow in the loops, secondary-side transients, and greater potential 
for sodium-water reactions. If the project moves forward, a detailed 
design review and an addendum to the FSAR should be required. 
Since conversion to metal fuel is demanding extensive use of the 
contractor's resources, it is conceivable that undertaking another 
sizable project at the same time could detract from both efforts. 
Indeed, the power addition represents a fundsimental new departure 
for FFTF and raises questions as to whether the new direction offers 
sufficient benefits to justify the cost in increased complexity and 
diffusion of mission. 

Recommendation: The preliminary design of the proposed power addi- 
tion should receive thorough review by the newly formed DOE Advisory 
Committee on Nuclear Facility Safety before a detailed design phase 
is initiated. If a final design is undertaken, it should also receive 
internal and external safety reuew. DOE should carefully consider 
the wisdom and timing of undertaking a power addition at FFTF. 
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High Flux Beam Reactor (HFBR) 



The High Flux Beam Reactor (HFBR) is operated by the 
Bi;ookhaven National Laboratory (BNL), which is located on Long 
^faud, some 50 miles east of New York City. The reactor uses heavy 
water (BjO) as coolant, moderator, and reflector. At start-up in 
1965, the nominal operating power was 40 MW; an upgrade in 1982 
raised the power level to 60 MW. The primary mission of the HFBR is 
bztsic scientific research, particularly neutron scattering experiments 
using the reactor's external thermal neutron beams. Other purposes 
include isotope production, neutron activation analysis, and materi- 
als irradiations. 

The HFBF is staffed with 65 people. It had an FY 1987 operating 
budget of $10.u million, some 18 percent of which was dedicated to the 
operation of security programs. Construction costs of these security 
programs, which were installed to meet DOE requirements, were $1.9 
million in FY 1986 and $1.5 million in FY 1987. An additional $1.4 
million is budgeted for FY 1988. 

The reactor fuel consists of U-235 contained in a cermet (ceramic 
plus metdl) made of UaOg and aluminum. The cermet is 37 percent 
UsOs by weight, and the uranium is 93 percent enriched. A fresh 
core contains a total of 9.8 kg of U-235. The fuel is fabricated into 
plates, rather than pins, and a typical fiiel plate measures 23 in. by 
2.4 in. by 0.05 in. After final cold-rolling, the plates are crrved to 
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a 6-in. radius by being pressed against a curved die. The plates are 
clad with aluminum and mounted in a fuel element assembly, also 
made of aluminum. There are 18 fueled plates per element, typically 
spaced 0.102 in. apart. Each fiiel element is apprc .imately 3 in. 
square by 5 ft long. Twenty-eight such elements form the HFBR 
core. The active core volume is 23 in. high by 19 in. in diameter. 

The reactor incorporates several unusual design features in order 
to provide external beams of thermal neutrons. One design goal 
was to have the thermal neutron flux maximized outside the core, 
where beam tubes could intercept the flux and channel it out to 
the experimental facilities. To this end, the core sits in a bath of 
heavy water contained within the reactor vessel. The heavy water 
that surrounds the core acts as both moderator and rePector; it 
thermalizes the fast flux, and reflects some of it back into the core. 
The power level is controlled by absorber blades that mask the core 
from the bath; insertin<^ the blades reduces neutron reflection from 
the heavy-water moderator, causing the reactor to go subcritical, 
which in H'jn causes power and the average core temperature to 
fall. To stabilize power at a lower level ar d temperature, the blades 
must be returned to the blade position that produces criticabty at 
the new lower temperature. In normal operation the flux of thermal 
neutrons is larger in the reflector region than in the core, while the 
fast flux peaks in the core. The peak thermal flux is 1.05 x 10^^ 
neutrons/cm^/s. 

The heavy water used as moderator and reflector is also used as 
coolant. The primary cooling system contains 10,000 gal. of heavy 
water, flowing at 18,000 gpm. About every 18 months, one-third 
of the total heavy-water inventory is removed and exchanged for 
heavy water having a lower tritium concentration and higher purity. 
The purpose is to keep personnel exposures to tritium as low as 
reasonably achievable. Detritiated heavy water is currently obtained 
from Savannah River at subsidized rates. After FY 1989, however, 
these supplies will no longer be available. BNL is investigating the 
use of Canadian sc-irces to detritiatc HFBR heavy water. The cost 
for such services is estimated to be between $500,000 and $1 million 
per year. 

Coolant velocity through the fuel elements is almost 40 ft/s. The 
temperature of the coolant rises from ISO^F r.t the inlet to 15VF at 
the outlet. There are two primary loops, each with its own pump 
and heat exchanger. Heat is dumped to light-water cooling towers. 
The pressure in the primar> system is much greater than pressure in 
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the secondary system (250 psig at the lowest elevation of the primary 
system versus 45 psig in the secondary), thus preventing light water 
Srom entering the primary system through any leak in the interface 
between the systems. 

The required system pressure is determined by the need to pre- 
vent boiling at the hottest spot in a freshly fueled core. The boiling 
point of D2O at atmospheric pressure is 214*^. With a hot spot 
surface temperature of 357*^, a pressure of 164 psig is required to 
suppress boiling. Helium gas at 200 psig is used as a cover gas in the 
reactor vessel to maintain the necessary pressure. 

There are nine horizontal beam tube thimbles welded into the 
reactor vessel. The beam paths penetrate the thermal/biological 
shield. Eight of the beam tubes have 3.5-in. diameters and extend to 
within a few inches of the core. One of them points directly at the 
core to provide a fast neutron beam. A typical flux supplied to an 
experimental area is 4 x 10^ neutrons/cm^/s. The ninth horizontal 
tube serves as a "cold neutron" facility; the tube of the cold neutron 
facility is 1 ft in diameter and stops at 1 ft from the core. The cold 
neut^•'^n facility uses 1.4 1 of liquid hydrogen as moderator, producing 
a beam of very low-energy neutrons. 

Also projecting into the reactor are seven vertical tubes (thim- 
bles) used for sample irradiations. The tubes provide three positions 
for irradiating samples in the heavy water moderator, two very near 
the core, and two in the core center. A typical cylindrical sample 
volume is 3 in. long by less than 1 m. in diameter. 

The HFBR accident analyses focus on loss-of-coolant and loss- 
of-flow events. Mitigation of a potential loss-of-coolant accident 
(LOCA) depends heavily on an elevated tank of light water tha'. 
is poisoned with cadmium nitrate (a neutron absorber). (The con- 
tractor's analyses of potential LOCAs and the phenomenon of flow 
reversal are discussed in greater detail below.) In loss-of-flow scenar- 
ios at HFB*:, whether the reactor coolant system is depressurized or 
not, the coolant, which is normally pumped downward through the 
core, stagnates, and then reverses direction, as a result of natural con- 
vection. This flow J versal cannot be allowed to occur immediately 
after shutdown from normal 60-MW operation, because immediately 
after shutdown the rate of decay heating is too high for flow reversal 
to occur with sufficient speed to prevent fuel melting. Thus, one of 
the two major system upgrades associated with an increase in power 
level from 40 MW to 60 MW was the addition of battery-powered 
pony moiors to the coolant pumps. These motors serve to assure at 
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least 3 minutes of downflow cooling in the event of a power blackout 
and delay flow reversal until the decay heat has fallen sufficiently to 
allow flow reversal to occur without fuel damage. (The other upgrade 
was in the primary heat exchemgers.) 

The HFBR its control room are enclosed in a confinement 
dome designed to withstand an internal pressure of 2 psi. In normal 
operation, a slight negative pressure is maintained within the dome 
to ensure that any air leakage is inward. Exhaust gases are filtered 
and discharged to the atmosphere from a high stack. 

The future of the HFBR depends primarily on aging and on 
the continued need for the facility. The reacf^'^r is 23 years old and 
the original design was for a 25-year lifetime. Extensive studies 
of aging have been conducted. The DOE asserts that HFBR will 
continue to operate until a planned advanced neutron source, which 
could replace both HFBR and HFIR, is operational in the late 1990s 
(National Research Council, 1988]. 



Each operating cycle at HFBR lasts approximately 1 month. The 
reactor operates for 24 days, after which 14 of the 28 fuel elements 
are replaced. The turnaround time for refueling, maintenance, and 
surveillance testing is typically 4 to 7 days. In most years there are 
11 cycles scheduled, leaving 1 month free for more thorough inspec- 
tions or modifications. One recent cycle was dedicated to replacing 
some secondary water piping, and only 10 cycles are scheduled for 
FY 1988. 

A review of the 47 UORs from the past 5 years does not show any 
serious recurring problems. The two most common problems were 
associ?*^ed with cooling of the Cold Neutron Facility and spurious 
events caused by unrelated instrumentation anomalies that resulted 
in accidental scrams. The next most common problems were difficul- 
ties with the personnel access doors, resulting in temporary breaks in 
the building confinement, and leaks m the secondary cooling piping. 
(This pipmg has now been replaced.) The remaming reports cover 
a variety of incidents, ranging from incoming power interruptions 
to administrative shutdowns. Two significant unusual occurrences 
during the past five years are described below: 

1. In March 1986 the stator of the A primary pump motor failed 
because of unanticipated aging and caused a reactor shutdown. The 
following cycle was run at 40 MW, single loop operation. At the next 
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shutdown in April, the motor was replaced and operation resumed 
at 60 MW. The B primary-pump motor was replaced in 1987 as a 
precaution. 

2. In December 1984 the main control rod Ml failed to fully 
insert following a scram. The rod stopped 4 inches short of the usual 
3C inch Lisert position. The incident occurred during shutdown, 
with the reiictor unfueled and depressurized. The cause was never 
determined. It is speculated that foreign material in the internal 
drive mechanism may have later cleared itself. 

HFBR has had about four major j»ldot modifications per year 
since start-up in 1965. Currently, there are 13 such modifications in 
the planning stage, including a system to provide remote monitoring 
of HFBR plant variables, remote control of shutdown cooling, and 
provision of a remote, alternative supply of light water for the poison 
water tank. 

TECHNICAL ISSUES 
60-MW Operation 

Conclusion: The change in the operation of the HFBR from a 
power level of 40 MW to a power level of 60 MW has involved 
a significant change in safety philosophy. 

At 40-MW operation, the HFBR safety analysis report indicates 
that no fuel melting would be expected to occur over a broad range 
of accidents (BNL, 1964a]. It states, for example, that "the system 
has been designed so that even a gross rupture of the primary vessel 
or prim&xy coolant lines will not uncover the core and cause fuel 
melt." This statement is based on the design of the KFBR that 
involves a catch tank around the primary vessel that can prevent 
the core from being uncovered in the event of leakage, such as from 
the rupture of a beam tube. The reactor also has a flow reversal 
capability that allows core cooling to switch from forced downflow 
cooling to n^tur^^ circulation in which the flow is upward through the 
core. Out-of-pile tests were conducted to establish the conditions for 
flow reversal. Based on the test results, fly wheels were incorporated 
on Iht* primary pumps to ensure that, in the event of loss of power to 
the pumps, cooling would continue until flow reversal could be safely 
established after shutdown from 40 MW. 

A reanalysis was made before operation at 60 MW and an ad- 
dendum (dated April 1982) to the Final Safety Analysis Report 



ERIC 



So 



76 



was prepared and approved [BNL, 1982). This addendum and the 
supporting documentation indicate that about 3 min. of downflow 
cooling must be mamtained following shutdown from 60 MW. Pony 
motors were incorporated to provide greater assurance that 3 min. 
or more of downflow cooling would be provided. However, in the 
event of any system rupture greater than the equivalent of about a 
1-in. diauneter pipe, the loss of coolant is estimated to lead to pump 
trips and the loss of the necessary 3 min. of downflow cooling. Thus, 
unlike operation at 40 MW, such a break at 60 MW could lead to 
fuel melting. In addition, the failure of the driving mechanism for 
the "auxiliary" control rod that is used for control of the lower core 
region is expected to cause "some fuel melt" at 60 MW, whereas "no 
expected fuel melt" was predicted for 40-MW operation. 

The approval of the change to 60-MW operation was based on a 
review of the potential consequences to public health by BNL staff. 
Dose estimates at the laboratory site boundary from fuel melting 
were less than the limits for commercial reactors found in 10 CFR 
100.^ While estimates of doses to individuals beyond the site bound- 
ary were low, the increased probability of fuel melting at 60 MW 
increr jes the potential for effects to individuals at the site. The 
procedures for abnormal conditions (such as, the response to loss-of- 
coolant accidents) can necessitate operator actions (e.g., manually 
openmg valves) within the confinement building. Although reviews 
by BNL indicate that these £u:tions can be accomplished during an 
accident (BNL, 1986a-b, 1987b, 1987f], the dose rates to operators 
were not estimated because of the presumed low probability of an 
event that might lead to high radiation exposures. The Brookhaven 
PRA, scheduled to begin in July 1988, should attempt to determine 
whether this presumption is valid. There are plans in progress to 
modify the reactor to allow for remote operation of the most impor- 
tant systems, but operator exposures for these planned operations 
are not clear either. 



These dose estimates were made for a spectrum of accidents involving 
fuel damage, including a hypothetical design-basis accident in which the entire 
core was melted [BNL, 1979c]. In all cases, the estimated impacts on the 
public beyond the site boundary were slight. Exposures to visitors, laboratory 
scientists, and other persons at the site are typically not included in such 
calculations. However, in connection with its approval of 60-MW operation, 
DOE did request and review the contractor's dose estimates for exposures to 
the onsite population from such an accident. 
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Recommendation: A realistic asaeasment ahould be made of poten- 
tial doae ratea from fiaaion products and ezpoaure to operator a during 
poaaible accidenta at HFBR to ensure that adequate protection is pro- 
vided to operationa personnel and to other individual at the site. This 
assessment should include a realistic evaluation of the requirements 
for evacuation and remote control of reactor shutdown and for estab- 
lishment of long-term core cooling. While the timely accomplishment 
of portions of the assessment may involve deterministic analyses^ the 
assessment should be integrated with the PRA. 



Flow Revergal 

Conclusion: The design and operating limits to ensure ade- 
quate cooling during flow reversal were established based on 
tests designed and conducted in 196S. The need to simulate 
the dynamic thermal-hydraulic behavior of the reactor in the 
test was not considered, although in response to committee 
questions a preliminary analysis of inertial effects has been 
completed that indicates that the 196S tests were conservative. 

As discussed above, the HFBR design allows the coolant flow 
to reverse from forced downflow cooling to natural circulation with 
upflow through the core when the reactor is shut down from full 
power. The decay heat generated in the fuel plates must be ade- 
quately removed during thb flow reversal process, or fuel melting 
may result. Prior to the initial start-up of the reactor, a series of out- 
of-core experiments were conducted with simulated fuel channels and 
a mocku; of the flow reversal system. The tests indicated that core 
cooling during the flow reversal ^ould be expected to occur without 
fuel damage [BNL, 1963]. 

During its review, the committee raised questions with BNL 
staff as to the adequacy of the test loop to simulate the reactor. 
In particular, the committee focused on dynamic thermal-hydraulic 
effects in the period during which the heated fuel plates experience 
a flow-stagnated condition, such as the time required for flow over 
the heated plates to decelerate and reverse. BNL believes that the 
temperature limits based on the original test results are conservative 
even when such dynamic effects are taken into consideration (BNL, 
1988m]. Since dynamic effects were not considered in the original 
design of the experiments, it is important that a more careful and 
thorough review be undertaken to confirm that the limits are indeed 
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conservative. Analysis of the flow-reversal phenomenon at HFBR 
should be conducted using modern numerical simulation techniques. 

Recommendation: A preliminary analysis of flow reversal effects at 
HFBR previously provided to the committee should be completed and 
reviewed by the Brookhaven Reactor Safety Committee, by DOE, and 
by the DOE Advisory Committee on Nuclear Facility Safety. This 
bounding analysis should be supplemented by a numerical simulation 
using modern reactor codes to determine whether the tests conser- 
vatively model the heat-up processes of the reactor fuel under flow 
reversal conditions and whether the limits derived from the experi- 
mental tests are valid. 

Control Room Staffing 

Conclusion: The current method of operation allows the con- 
trol room to be manned by only one person during all or any 
part of a shift. 

It is current practice at HFBR to have two operators and one 
supervisor on shift. (The supervisor is a qualified operator.) The 
mam duties of operating the plant are performed in or near the 
control room, but various actions and checks are required either 
routinely or for other reasons in various parts of the plant. Under the 
current procedures both the supervisor and one of the operators could 
be away from the control room simultaneously. In the conmiittee's 
judgment, it is not good practice to allow the control room of an 
operating reactor to be manned by only one qualified operator. There 
should be at least two qualified operating personnel in the control 
room at all times during reactor operation and during refueling to 
respond to occurrences that could affect the safety oi the plant. 

Recommendations: The technical specifications for the HFBR should 
be revised to require that the control room be manned at all times 
by no fewer than two qualified operating personnel while the plant is 
operating or being refueled. DOE should develop a consistent policy 
for control room staffing for all of the test and research reactors. 

Light- Water Ingress 

Conclusion: The addition of light water into the HFBR core 
region can cause substantial reactivity increases. The safety 
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of the plant depends upon continued vigilance and training to 
avoid a reactivity-induced excursion from the addition of light 
water. Operators may be exposed to a high-radiation envi- 
ronment in using the existing emergency system for addition 
of light'water coolant 

Light- Water (H3O) Injection into the Primary 
Heavy- Water (D2O) Cooling System 

As described in the FSAR, the addition of light water to the 
HFBR core can substantially increase reactivity. The addition of 
light water would also reduce the effectiveness of the reflector control 
rods. It is possible under these circumstances for the light-water 
flooded core to become super-critical even with all the control rods 
inserted. This means that power levels could increase very rapidly. 

To avoid a potential reactivity excursion owing to the addition 
of light water, the contractor controls all sources of light water and 
conducts reviews to ensure that any significant injection of light 
water is avoided. There is only one direct connection in HFBR 
between a light-water system and the primary heavy-water system. 
This connection is through a tank filled with a solution of cadmium 
nitrate. The system is designed so that the solution of cadmium 
nitrate (a neutron ^poison") can be added if needed as a backup 
method to assure reactor shutdown and to keep the core covered in 
the event of a loss of heavy water coolant. 

If light water were needed to keep the core cooled, the system 
would be actuated manually by aligning three valves in the piping 
leading to the tank full of cadmium nitrate. After the cadmium 
nitrate tank is empty, additional light water can only be added by 
operation of an additional spring-loaded valve. The spring-loaded 
valve was designed to close automatically when released so that it 
cannot be inadvertently left in the open pc iion. The operating 
procedures specify that light v/ater is to be added only to make 
up for losses from boiling. The practice of permitting only limited 
makeup of coolant is to ensure that the cadmium nitrate neutron 
poison is not flushed out of the core by subsequent addition of light 
water; poisoned coolant must remain in the core to prevent re- 
criticality. The operator must make the appropriate adjustment 
of valves during an accident within the confinement — that is, in a 
potentially hazardous environment. 

Although the committee was informed that the operator at the 
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spring^loaded valve cannot directly read the water level in the reactor 
vessel — an essential measurement if light-water addition is to be 
limited to the replacement of losses caused by boiling — remote water* 
level readings are being installed this year (1988). The concentration 
of cadmium nitrate in the tank is checked annually in accordance with 
the reactor technical specifications, and no problems in maintaining 
proper concentrations have been found. The overall system and 
other sources of possible light-water addition were reviewed by BNL 
in August 1986, and the possibility of light-water flooding of the core 
without neutron poisoning was estimated by the contractor to be 
acceptably small [BNL, 1986b]. The contractor's PRA should aim to 
determine whether this conclusion is valid as well. The light-water 
addition system is suflSciently dependent on proper operator action 
that special care must be ta)cen. 



Light- Water Injection into the In-Core Thimbles 

HFBR has in-core thimbles that are used to irradiate materials 
samples in the high neutron flux regions of the reactor. These thim- 
bles are cooled internally by the circulation of heavy water through 
an "experimental cooling system" that is separate from the primary 
heavy-water system. The heat exchanger for this system is cooled by 
light water at a pressure higher than the pressure of the heavy water 
in the experimental cooling system. The committee is conceroed 
about the possible effects of light-water leakage into the experimen- 
tal cooling system and subsequent injection into the in-core thimbles, 
causing a positive reactivity insertion. This question has not been 
analyzed in the FSAR. Preliminary analysis by BNL in response to 
our inquiry suggests that any such leakage would not be a problem 
[BNL, 1988k], but the analysis needs to be formalized and properly 
reviewed. 

Recommendation: Continual vigilance is necessary to ensure that 
light-water (H^O) additions to the heavy water (D^O) cooling system 
do not inadvertently occur. Because operator actions are involved, this 
vigilance should include special training to explain not only the proce- 
dures but also the basis for the requirements, and thereby to motivate 
the operators to take special care to ensure that the neutron absorbing 
cadmium nitrate solution is always added and remains present dur- 
ing any light-water additions. Training and analysis should give due 
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consideration to unexpected conditions, for example, possible strat- 
ification or over-dilution of the cadmivm nitrate solution. Planned 
improvements should be implemented to provide remote reading of the 
water level in the core at stations where light water can be added to 
the reactor coolant system. A realistic assessment should be made of 
potential dose rates and operator exposures during manual operation 
of the light-water addition system. 

The contractor's preliminary analysis of water injection into the 
in-core thimbles should be formalized, including an analysis of tran- 
sients and consequences. This analysis should be reviewed and added 
to the Final Safety Analysis Report. 



Conclusion: Beam tubes in the HFBR are being embrittled 
by prolonged exposure to neutron irradiation. Although the 
problems encountered at neutron scattering facilities abroad 
as a result of beam tube embrittlement have not yet arisen at 
the HFBR, tube embrittlement may limit the useful life of the 
reactor. 

The HFBR has beam tubes that channel neutrons outside the 
reactor vessel for use in neutron scattermg experiments. The beam 
tubes are integral parts of the reactor vessel. Safe operation of the 
reactor thus requires maintenance of the integrity of these tubes. 

The beam tubes are positioned close to the reactor core and re- 
ceive very high exposures to neutron irradiation. Neutron irradiation 
embrittles metals; indeed, several different types of problems have 
arisen at high flux reactors in France because of embrittlement. 

When the HFBR was designed and c'>nstructed, it was assumed 
that vessel embrittlement would occur progrc*»sivel;* through atomic 
displacement. To monitor the progressive embrittit»r:'»nt of the vessel 
over the life of the reactor, surveillance specimens of 6061-T6 alu- 
minum alloy (of which the beam tubes were made) were suspended 
in regions of high neutron irradiation. As expected, examination of 
<«hese specimens has shown reductions in metal ductility as a result 
of prolonged irradiation* However, the reduction has been caused by 
the transmutation of aluminum atoms to silicon atoms rather than 
as a result of atomic displacement [BNL, 1988e, ig88i]. 

Certain French reactors have experienced complete loss of beam 
tube ductility through prolonged irradiation. However, the alu- 
minum alloys used in these reactors contained significant amounts of 
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magnesium. The loss of ductility was the result of the transmuta- 
tion of aluminum to silicon, which led to the prompt precipitation 
of intermetallic compounds of magnesium silicide. When fabricated, 
the 6061-T6 alloy used in the HFBR contained little magnesium, 
and the magnesium that was there was largely reacted with silicon 
during the fabrication proceed. Consequently, the HFBR alloy is not 
as susceptible to rapid embrittlement as alloys rich in magnesium, 
like the ones used in ine French reactors. Npr does it appear that the 
HFBR alloy is as suuceptible to stress cori'osion cracking or pitting 
corrosion as the French alloys. 

Nevertheless, as irradiation progresses, more and more silicon 
is produced in the tips of the HFBR beam tubes. Because silicon 
has a limited equilibrium solubility in aluminum, the potential for 
precipitation of brittle silicon in the alloy increases with continued 
irradiation. The equilibrium solubility of silicon in aluminum is 
only about 1 percent. Silicon concentrations of nearly 8 percent 
have been observed in some surveiUance specimens at HFBR. There 
may be kinetic barriers to the nucleation of silicon precipitates that 
explains why precipitation has yet to occur. However, as the level of 
supersaturation increases, it is likely that these kinetic barriers wo^ild 
be less effective in preventing precipitation. Indeed, at some point, 
sudden precipitation of silicon could occur spontaneously. Silicon 
concentrations as high as 14 atom percent have been projected for 
the HFBR over the next 10 full-power years. 

The contractor and DOE are aware of the progressive embrittle- 
ment of the HFBR beam tubes, and the threat that it poses. They 
have solicited external review and advice on the potential impact on 
the integrity of the HFBR coolr* t system. Unfortunately, little is 
known about the behavior under irradiation of 6061-T6 alloy at neu- 
tron fluences gre^^^er than those already experienced at the tips of the 
HFBR beam tubes. The expert reviews that were undertaken con- 
cluded that continued monitoring and study of tube embrittlement 
are needed. 

Because the HFBR is cooled with heavy water, some tritium 
is produced during normal operation. The contractor believes that 
cracking or perforation of the beam tubes would be detected by tri- 
tium leakage before catastrophic rupture could occur [BNL, 1987d]. 
But the nature of tritium le^age from a defective beam tube has not 
been defined. 

Quite clearly, there is a need to monitor closely the loss of 
ductility of the HFBR beam tubes. With increasing exposure, the 
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continued integrity of these tubes will be more suspect. If the tubes 
cannot be replaced at reasonable cost, embrittlement will eventually 
limit the useful life of the reactor. Meanwhile, the contribution of 
beam tube embrittlement and potential tube rupture to the risk of 
accidents at the HFBR needs to be fully assessed, along with the risk 
of a beam tube rupture exacerbating an accident initiated by some 
other means. 

Reeommendation: The eommittee endorses continued monitoring and 
study of beam tube embrittlement at HFBR. The contractor skotdd pay 
careful attention to uncertainties in beam tube rupture in the PRA 
currently under way at the HFBR. DOE should explore coat-effective 
means for replacing the HFBR beam tubes. 
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High Flux Isotope Reactor (HFIR) 



The High Flux Isotope Reactor (HFIR) is located in eastern Ten- 
nessee at the Oak Ridge National Laboratory (ORNL). It is operated 
on behalf of the DOE Office of Energy Research by Martin .Marietta 
Energy Systems, Inc. The reactor reached its design power of 100 
MW in 1966. Its primary mission is the production of transuranic 
radioisotopes. The types and amounts of radioisotopes produced at 
HFIR in 1986 are shown in Table 2. HFIR provides significant mate- 
rials irradiation capabilities, as well as facilities for neutron scattering 
experiments. The operation staff consists of 88 people, and the FY 
1987 budget was $11.4 million. The FY 1988 budget request was 
$19.6 million. 

HFIR is a flux-trup reactor that is designed to provide especially 
high fluxes of neutrons that have thermal energies. Thermal neutrons 
at high fluxes are needed to produce transuranic isotopes efficiently. 
The reactor uses light water as coolant isid beryllium as reflector. 
The core is designed as a series of concentric cylmders approximately 
30 in. high with an active fuel region that is 20 in. lon^-. The central 
shaft, 5 in. in diameter, comprises the flux trap. When a target is 
inserted in the core, the average flux in this area is about 5 x 10^^ 
neutrons/cm^/s, and about one-half of the flux is thermal. 

The core consists of two annuli of fuel plates. There are 171 plates 
in the inner annuius and 369 in the outer. The plates consist of a 
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TABLE 2 Isotopes Produced at HFIR in FY 1986 



Element 
(arranged 
by weight) 



HalMife 



Radioactivity 
Mass Produced (millicuries) 



Pho3phorus-33 

Calcium'41 

Iron-55 

Cobalt-60 

Nickel-63 

Selenium->75 

Strontium'85 

Zirconium-95 

Tin-119m 

6arium*135m 

Gadolinium'153 

Ytterbium-169 

Iridium-192 

Curium-248 

6erkelium'249 

Califomium-252 

Einsteinium-253 

Ein3teinium-254 

Ferniium-257 



2.7 y 
5.27 y 
100. y 
119.8 d 

65.2 d 

64. d 
293. d 

28.7 h 
242.4 d 

32. d 



320.d 
2.64 y* 



20.4 d 
275.7 d 
100.5 d 



25.4 d . 
1.04x10 y 




0.005 mg 
5.894 g 
0.410 mg 
226.2 g 
2.6 g 
0.646 mg 
0.032 mg 
0.003 mg 
C 959 mg 
0.014 mg 



212.0 mg 



150. mg 
50. nig 
500. mg 



0.207 mg 
53.6 g 



2. mg 
4.g 
1- Pg 



8.1x10^ 
5.0x10^ 
1.0x10^ 
2.6x10^ 
1.5x10, 
9.4x10^ 
7.5x10^ 
5.6x10^ 
3.6x10^ 
1.1x10* 
7.5x10, 
5.0x10^ 
4.9x10** 
6.3x10" 
8.2x10^ 
2.7x10^ 
5.1x10, 
7.5x10 
5.1x10 




Cf->252 has a neutron output from spontaneous fiesion of 2.3 x 10 
neutrons/s/g. 

cermet fuel made of UaOg and aluminum, with aluminum cladding. 
The uranium is enriched to 93 percent U-235. A fresh core contains 
about 9.4 kg of U-235 and 2.8 gm of Boron-10. 

Immediately outside the fuel annuli are two neutron-absorbing 
control cylinders, each about 0.25 in. thick. The cylinders are each 
three times the height of the core, and have different absorbers at 
different altitudes. The net reactivity is altered by moving the control 
cylinders up or down. The absorbers are tantalum and europium 
oxide (EU2O3). 

Outside the control cylinders is the beryllium reflector, con- 
structed in a series of annular cylinders that total to about 1 ft ih 
thickness. The four externa^ beam tubes protrude into the inner half 
of the reflector cylinders to pick up neutrons. The 20 vertical exper- 
imental irradiation facilities are in the outer portion of the reflector; 
flux there is about 1 x 10^^ neutons/cm^/s. The outer periphery 
of the reflector also includes four tubes to channel neutrons from 
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the reflector exterior to an experiment room located above the main 
beam room. 

The pressure vessel is eight feet in diameter, and is made of 3-in. 
stainless-clad carbon steel. It sits in a reactor pool, which is 18 ft 
in diameter and filled with water. The top of the reactor pressure 
vessel is 17 ft below the surface of the water. The pool contains 
the reactor vessel, provides biological shielding, serves as a heat sink 
and a source of emergency makeup water, and offers access to the 
storage pool. The reactor pool in which the HFIR is submerged is 
a noteworthy safety feature. In many of the hypothesized accidents 
that might occur at HFIR, any fission products released from the fuel 
would have to pass through the 17 ft of water in the pool. It is well 
established that as long as the water in the pool remains below the 
boiling point, it couxd be effective in scrubbing cesium and iodine, 
but not noble gases, from gases sparging through it. 

Three vertical centrifugztl pumps propel the light water coolant 
through the primary loop at about 17,000 gpm. The vessel inlet 
pressure is 750 psi. The coolant enters through two pipes high on the 
vessel, and flows downward through the core, entering at 120^F and 
exiting at IBO'^F. It leaves the bottom of the vessel through one large 
pipe, which feeds three of four parallel heat exchangers; the fourth is 
kept on standby. The secondary loop subsequently dumps the heat 
into three of four conventionztl cooling towers. 

The neutron scattering facilities consist of eight spectrometers 
fed by the four beam tubes. Typical beam tube flux for the monochro- 
matic beam at the sampling position is 10^ neutrons/cm^/s. There 
is also a small-angle scattering facility operating at much lower flux. 

The reactor confinement normally operates under a small nega- 
tive pressure. The interior air is exhausted to the atmosphere through 
banks of filters and then through a 250-ft stack. 

HFIR has not operated since November 1986. ORNL shut the 
reactor down when it was discovered that the pressure vessel was 
being embrittled by exposure to neutrons at an unexpectedly rapid 
rate. Reactor operations have remained suspended as mvestigations 
have been conducted into the embrittlement problem and the causes 
of the delay in its discovery. The contractor has also labored to 
respond to various recommendations for improving other aspects of 
plant operations while the reactor has been shut down. 
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RECENT OPERATING HISTORY 



In the 5 years preceding shutdown in November 1986, HFIR 
averaged an annual availability factor of 84 oercent, with only about 
one week of unplanned outage per year. When operating at 100 MW, 
the nominal fuel cycle was 22.5 days. 

In a typical year of operation 25 percent of the unusual occur- 
rences reported to DOE resulted from a loss of AC power to the 
reactor, usually caused by lightning. Another 25 percent weis due to 
trips resulting from extremely low trip thresholds during tests of the 
safety subsystems. 

Recent operating events prior to the 1986 shutdown included the 
following: 

• In January 1984, with the reactor at about 40 percent power, 
the seat light for one of the safety rods actuated in the control 
room, and the operators manually scrammed the reactor. 
When the reactor was scrammed, the safety rod in question 
failed by about 3/4 in. to insert completely. A subsequent 
investigation indicated that the lower section of the safety 
rod had fallen off. Thjs section, csJled the piston section, is 
normally screwed onto the assembly and staked by peening in 
three places. In this case all three stakes had worn through, 
and vibration caused the piston to unscrew itself. 

• In January 1986, tantalum was detected in the demineral- 
izer effluent. Investigation revealed a failure of the cladding 
over the tantalum on three control plates of the mner con- 
t-ol cylinder. The failure W2is traced to inconsistent epoxy 
bonding during fabrication in 1976. Originally there were 
five such plates that were found to be "nonconforming" but 
were considered serviceable. Three of them were leaking tan- 
talum by 1986. Following the mcident, the three damaged 
control plates were replaced with spare plates, one of which 
was one of the original five defective plates. After shutdown in 
November 1986, inspection of this plate showed a 1-in. diam- 
eter blister in the cladding of the europium control material. 
An investigation by the contractor concluded that "failure 
appesurs imminent, so the cylinder will not be used in the 
future," but in any event "the only result would have been 
a slight contamination of the primary coolant system, which 
could have been cleared up with no operational problems." 
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In the 20 years of operation preceding the current shutdown, 
there were about 180 plant modifications. All but two of the modifi- 
cations were regarded as updates of existing systems or components, 
and, as such, were interpreted as not requiring DOE review or ap- 
proval. This mcluded phase one of the HFIR Irradiation Facility 
Improvement (HIFI) project, which involved redesign of the target 
tower assembly and associated reactor components. Other signifi- 
cant plant modifications since steurtup included improved bearings 
and bearing mounts for the control plates, coolant stramers with 
longer service life and varying mesh sizes, and the upgrading of 
electronics with integrated circuits. 

FoUowing the November 1986 shutdown there have been about 
10 modifications proposed, all of which were submitted to DOE for 
review and approval. According to the contractor, these modifica- 
tions have now been completed. Two of them involved installation 
of a seismic scram capability and the strengthening of the prhnary 
system and reactor pool against earthquakes. The remainder were 
associated with monitoring and maintaining a new lower limit for 
operating pressure and temperature. 

TECHNICAL ISSUES 
Management of the High Fhix Isotope Reactor 

Conclusion: DOE and the contractor have determined that 
management deficiencies by both organizations were the cause 
of serious breakdowns in the safe operation of HFIR. Restruc- 
turing of management is now under way. 

When the HFIR was constructed, it was recognized that over 
time the pressure vessel steel would be embrittled by exposure to 
neutron irradiation. Surveillance specimens of various steels used in 
the construction of the preesure vessel were suspended in the reactor 
so that the rate of embrittlement could be monitored. As discussed 
in greater detail below, in 1986 it was discovered that specimens 
withdrawn for analysis in 1983 had not in fact been analyzed. When 
these specimens were analyzed, it was found that the reactor had 
been operating for several years at temperatures that were outside 
the technical specifications — that is, outside limits that had been 
established for safety reasons. 

Discovery of the vessel embrittlement problem prompted closer 
exammation by DOE and the contractor of the euimmistrative and 
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management controls m place for operatmg the reactor. A large 
number of reviews, audits and appraisals were conducted at the 
instigation of both the contractor and DOE. A particularly critical 
review of contractor management was conducted by DOE's ES&H 
organization [DOE, 1987c]. The ES&H review called attention to 
eight major deficiencies: 

• InsuSicient upper level management emphasis on safety. 

• Insufficient resources expended for safe operation of the reac* 
tor. 

• Inadequate self-appraisstls and safety reviews. 

• Inadequate documentation and analysis of safety-related data 
and events. 

• Inadequate operator training. 

• Lack of adequate organizational controls, standards, and pro- 
cedures. 

• Lack of adequate control of nonoperational and maintenance 
activities that could affect reactor operation. 

• Lar' of effective functional quality assurance program. 

Taken together, these eight deficiencies represented a severe indict- 
ment of operations at HFIR. 

During its visit to the reactor, the connmiittee found that the 
contractor was attempting to respond fully to the criticisms. The 
considerable expertise of ORNL had been applied to reviews of the 
reactor and to the development of probabilistic risk and severe acci- 
dent analyses. In addition, upper management of reactor operations 
had been cha^^^^d. Nevertheless, the committee concluded that some 
of the problems identified in prior reviews appeared not to have been 
effectively resolved, it was apparent, for example, that upper man- 
agement was largely unfamiliar with the actual condition of systems 
within the plant. Leaking valves and jury-rigged plumbing indicated 
that maintenance of reactor facilities still lagged behind minimum 
expectations. The contractor's ^matrix" organization for conducting 
maintenance (see below) was still in force. There were indications of 
inadequate housekeeping. 

Breakdowns of the magnitude of those that were found at HFIR 
demonstrate failures by the local operations ofiice as well as the 
contractor. An important function of DOE's operations offices is 
to detect and correct breakdowns of contractor management and 
administration. Careful oversight of the contractor is the principal 
mechanism available to detect lapses in management and to alert 
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those with ultimate responsibility for safe operation to the need for 
corrective action. 

Subsequent to the committee's visit, the contractor and the de- 
partment have made further management changes. These changes 
are intended to increase top management involvement by the con- 
tractor and the operations office and to further increase DOE staff 
resources. Assessments of the management system by experts with 
commercial power experience and by departmental headquarters are 
to be completed prior to restart. 

Recommendation: DOE must ensure that the steps taken to correct 
deficiencies previously identified at HFIR have been effectively im- 
plemented both by the contractor and by the local DOE operations 
office. 

Vessel Embrittlement 

Conclusion: The HFIR contractor has formulated an oper- 
ating strategy that is thought to avoid the hazards posed by 
pressure vessel embrittlement The strategy is the product of 
considerable, external expertise that the contractor and DOE 
have brought to bear on the problem of embrittlement. How- 
ever, insufficient attention has been paid to the consequences 
of vessel failure and more careful evaluation of vessel failure 
should be included in the PR A, 

The HFIR has a pressure vessel consisting of c:irbon steel clad 
with stainless steel. At the time HFIR was designed, it was well 
known that the carbon steel base metal of the pressure vessel would 
undergo microstructural changes when subjected to irradiation by 
high energy neutrons. One effect of these changes results in a reduc* 
tion in the ductility of the steel. All carbon steel pressure vessels 
undergo a change from ductile fracture behavior to brittle fracture 
behavior as the temperature of the metal decreases* The transition 
temperature between ductile and brittle behavior is called the nil- 
ductility transition temperature (NDT). Under prolonged energetic 
neutron irradiation, the NDT of the carbon steel that constitutes the 
major part of the pressure vessel increases. 

The base metal of the pressure vessel, beam tube nozzles, and 
vessel welds of HFIR are made of different metal alloys with different 
NDTs. At start-up, the highest initial NDT of any of the metal used 
in the HFIR pressure vessel was O^F. All of the evidence available at 
the time the reactor was designed indicated that any change in the 
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NDT of the vessel material exposed to the highest flux in the reactor 
would be negligible, even after 20 years of full power operation. 

However, because radiation*induced embrittlement of steel was 
incompletely understood, a conservative technical specification was 
imposed to keep the plant from being operated while pressurized at 
temperatures below 70^F. This technical specification was expected 
to ensure that throughout the life of the vessel the NDT of the steel 
would never exceed the design criterion, which was that temperatures 
of the vessel should always remain BO^'F higher than the NDT (T > 
NDT + 60^F). This would serve to ensure that the vessel would not 
fail as a result of cracking. 

To monitor embrittlement, steel specimens (termed "coupons") 
were suspended in the reactor coolant adjacent to parts of the re- 
actor vessel shell and beam tube nozzles. These specimens were 
located in places that would enable :;arveillance of the range of ves- 
sel materials at points where the materials were subject to low and 
high fluxes of energetic neutrons. The plan was for specimens of the 
various materials to be withdrawn periodically and tested to ensure 
that the original projections concerning the effects of irradiation on 
the ductile-to-brittle transition of the HFIR pressure vessel steels 
remained valid. 

The practice of withdrawing and testing specimens of nozzle 
material was followed for a number of years. Data from the spec- 
imens indicated nominal shifts in the NDT. However, specimens 
of shell material — from which the reactor pressure vessel shell was 
constructed — including specimens at the location in the vessel of the 
highest neutron flux, were not withdrawn and tested at all prior to 
1983. In 1986, during a post-Chernobyl review, it was discovered 
that none of the specimens withdrawn from the reactor 3 years pre- 
viously had been tested [DOE, 1987a]. The specimens withdrawn in 
1983 included, for the first time, specimens of both nozzle and shell 
materials. When the 1983 specimens of high flux shell material were 
tested in 1986, they showed estimated NDTs for the vessel wall of 
55^F. If during this period the reactor was pressurized at TO'^F— and 
the contractor cannot establish that it was not— this would mean 
that it was operated in violation of technical specifications (NDT + 
60^F = 115^F). Additional samples of the same material pulled in 
1986 showed an NDT of 75^F for the vessel wall. The samples thus 
show that the reactor may have been operated not only in violation 
of technical specifications, but also under circumstances in which 
portions of the reactor vessel were susceptible to brittle fracture. 



115 



93 



The cause of the relatively rapid change in the NDT of the HFIR 
pressure vessel steels is not well understood. It has been hypothesized 
that slow irradiation by ihe unusual neutron spectrum from HFIR 
produces a rate of irradiation-induced embrittlement not heretofore 
known. Infoimation on the embrittlement rate is scant because cf the 
limited number of surveillance specimens and the type of specimens 
used at HFIR. Indeed, estimation of the rate of embrittlement of the 
HFIR pressure vessel is very uncertain because there are only two 
data points for vessel shell material exposed to the highest flux. 

There are other uncertainties. The HFIR pressure vessel Is a 
welded structure, ai.d it is often found that weld materials and the 
heat-affected zones surrounding welds are more susceptible to em- 
brittlement. Unfortunately, weld materials were not included among 
the surveillance specimens in HFIR. However, inferential data from 
other types of irradiation tests suggest that welds at HFIR are no 
more affected by irradiation than the bulk metal. 

In the face of these uncertainties, the HFIR contractor has de- 
veloped a strategy for continued operation (MMES, 19871). The 
contractor has proposed to operate the reactor at the same inlet 
temperature of 12(yF but at a reduced power of 85 MW and a re- 
duced pressure of 485 psi. A heating system will be installed co that 
pressurization of the reactor only occurs when temperatures in the 
pool are above QO'^F. The contractor is also proposing to conduct a 
iiydrostatic test of the pressure vessel aaaually at 900 psi and 85*^F. 
The test is intended to generate ratios of applied stress to fracture 
toughness of the metal that exceed any ratio of stress to fracture 
toughness that could develop during the next year of operation. In 
other words, if the vessel were to be susceptible to failure before the 
next hydrostatic test, the contractor asserts that the failure would 
occur during the test rather than during operations (MMES, 1988n]. 
The first of these hydrostatic tests was conducted last year. Although 
some unexplained acoustic signals were received during the test, the 
external reviewers and the contractor concluded that the test did not 
yield evidence of vessel fragility [BNL,1988; MMES, 1988n]. (The 
DOE Advisory Committee has establbhed a subcommittee to evalu- 
ate the degree to which the hydrostatic test provides assurance that 
the vessel will not fail during operation.) 

The proposed basis for continued operation is not consistent with 
the original criterion for pressure vessel integrity (NDT plus 60** F). 
Furthermore, the new operating regime results in a margin of no 
more than lO^'F between the estimated NDT of HFIR pressure vessel 
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steel and the new lower temperature limit for pressurized reactor 
operation, even though the estimated margin of error for mean NDT 
is ± 10° F. Thus, the new strategy does not provide any assured 
margin between the NDT and the temperature limit for pressurized 
operation, as specified in the original technical specifications. Any 
margin that does exist will be progressively reduced as the vessel is 
expv'>sed to further irradiation. The rate of embrittlement in HFIR is 
not known; the contractor believes that embrittlement of the vessel 
is subject to saturation [MMES, 1988n], and that the rate of em- 
brittlement is, at worst, linear, increasing by no more than 4^ to 5^ 
per year. Resumption of operation will require revised, well-justified 
technical specifications for pressurized operation. 

The contractor and DOE have solicited extensive expert opinion 
concerning the problem of vessel embrittlement, and the proposed 
operating strategy has been approved by skilled and knowledgeable 
outside reviewers. The reviews appear to have been focused almost 
exclusively on the question of the likelihood of vessel failure under the 
proposed operating regime, given uncertainties regarding the physi- 
cal processes involved in irradiation-induced embrittlement at HFIR 
[BNL, 1987; DOE, 1987b; MMES, 19871]. In the conrniittee's view, 
however, the risk of vessel failure must be judged not only in terms 
of the probability of occurrence, but also in terms of potential con- 
sequences. The only review of the consequences of vessel failure was 
conducted by the contractor, and it did not constitute an in-depth 
evaluation of all aspects of the problem [MMES, 19871]. Rather, the 
analysis consisted primarily of a recapitulation of an earlier analysis 
of vessel failure that was conducted in conjunction with the HFIR 
accident analysis report written more than 20 years ago. 

In essence, the contractor hypothesizes that sudden depressur- 
ization of the HFIR vessel would be no worse than the ^'maximum 
credible accidenf* analyzed in 1967 [Union Carbide Corp., 1967]. 
That is, rapid depressurization would induce fuel melting of 50 per- 
cent of the core, with attendant releases of a fraction of the ra- 
dionuclide inventory. As a result of recent experiments conducted 
with fuels similar to those used in HFIR, however, the releases of 
radionuclides postulated in 1967 may not be conservative. Indeed, 
the contractor's own Reactor Review and Audit Conmiittee raised 
questions in 1987 about the assumptions regarding releases contained 
in the original HFIR safety analyses [MMES, 1987a]. The committee 
concludes, therefore, that there has been insufficient reanalysis of 
possible accident consequences of vessel failure. 
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The Department and the contractor have recently conducted 
a Level 1 PRA of HFIR [Pickard, Lowe, and Garrick, Inc., 1988]. 
While accidents involving or initiated by pressure vessel failure were 
included in the study, the conixnittee found these analyses unconvinc- 
ing. It is not clear, for example, whether the conditional probabilities 
for vessel failure estimated by the PRA contractor take into account 
embrittlement of the reactor vessel. Moreover, the potential for ves- 
sel failure to exacerbate accidents initiated by other causes was not 
carefully examined. Both of these matters should be more carefully 
addressed. The committee recognizes, however, that the treatment 
of vessel failure in the HFIR PRA is uniquely challenging because 
of the absence of even generic deta on the probability of vessel fail- 
ure, because of technical uncertainties concerning the nature of the 
embrittlement processes at HFIR, and because of deficiencies in the 
understanding of radionuclide release once the HFIR vessel has failed. 

Recommendation: The contractor should reanalyze the consequences 
of vessel failure in light of modem knowledge of radionuclide releases 
and modern methods of accident analysis. Additional expert review of 
the treatment of vessel failure in the HFIR PRA needs to be under- 
taken, incorporating known uncertainties concerning the probability 
and consequences of vessel failure. 

Maintenance 

Conclusion: Maintenance work at HFIR has been conducted 
by employees assigned to a central laboratory mrintenance 
organization who are not under the supervisory control of the 
reactor manager. 

A number of staff changes have taken place at ORNL to 
strengthen the operatmg staff of HFIR and the safety review of 
the reactors. These have included assignment of new personnel to 
positions of responsibility, and enlargement of the operating staff in 
areas where experience has indicated it to be too thin in number and 
assured competence. These were necessary changes. However, there 
is one area affecting safety that continues to concern the committee: 
maintenance. 

Maintenance in all areas at Oak Ridge is conducted on a ^matrix" 
basis. When a maintenance activity is required that necessitates work 
by members of a particular craft, a work order is issued to obtain 
services from a central maintenance group. Thus, for example, the 
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same group of pipe fitters, is drawn on for work at HFIR as is used 
for work in other, nonreactor areas of the laboratory. The work 
is supervised by the laboratory's central maintenance group. This 
means that the director of the HFIR is not in direct charge of all of 
the individuals who do work on the reactor. Such a practice, unless it 
is carefully controlled, can undercut the fundamental responsibility 
for safety, which attaches to the director of the reactor. There 
were indications in a January 1988 DOE review of quality assurance 
practices at HFIR that prcblems continue to occur in this area [DOE, 
1988b]. In resp' iise to the DOE review, ORNL has taken steps 
to monitor maintenance activities at HFIR more closely [see, e.e., 
MMES, 1988j]. ^1.6. 

The committee believes that reactor safety would be better 
served if the reactor operations at ORNL had a small, in-house 
staff of maintenance personnel dedicated to reactor maintenance. 
This staff could then be trained and qualified specifically for work 
on the HFIR in order to ensure familiarity with the reactor and 
awareness of correct maintenance procedures and the consequences 
of maintenance errors. The director of the reactor and the mainte- 
nance manager would be responsible for evaluation of performance of 
individuals in this maintenance group. When the maintenance staff 
are not occupied with work on the reactor, they could still work on 
other tasks at ORNL, but their management and training should be 
optimized for reactor maintenance. 

Larger jobs might still require individuals from a central labora- 
tory work force or from ovitside the laboratory, but the work could 
then be conducted under direct surveillance and control by qualified 
in-house individuals. 

Recommendation: The contractor should dedicate a small in-house 
staff with a range of expertise to reactor maintenance. This staff 
should be under the direct supervision of HFIR management. The 
HFIR training program should be expandei to include training for the 
newly dedicated staff of maintenance workers.'^ 



While the report was going to prcM, the committee was informed that 
the contractor had recently made changes along the lines recommended in the 
report. The committee was not in a position to confirm these changes. The 
conamittee recommends that DOE and the contractor carefully monitor the new 
naaintenance organisation in order to ensure that, indeed, a properly sup'?rvised, 
high-quality maintenance program has been established at HFIR and is now 
operating effectively. 
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Conclusion 



The test and research reactors represent a significant national 
resource for scientific research, for the production of radioisotopes 
for medical and other purposes, and for advancing the knowledge 
of reactor technology. However, their capacity to continue to serve 
as tools for science, industry, medicine, and national defense will be 
jeopardized if the reactors are not operated in a way that comports 
with public expectations for reactor safety. Because several of the 
facilities were designed 20 to 30 years ago, they are confronting some 
expected, and some unexpected, problems of aging. Special and 
continuous activities to ensure safety are necessary. It is hoped that 
this report will oflFer helpful guidance to DOE in these efibrts. 

The committee also hopes that this report and its predecessor 
on th' defense production reactors will be viewed in the proper 
context. The real challenge confronting DOE is not only to respond 
to specific issues that this conunittee or others have identified, but 
rather, it is to establish a viable, vigilant safety enterprise that is 
capable of identifying and correcting safety issues without extensive 
outside prodding. Perhaps this is the most significant message of 
these reports. 

There are signs that the department and its contractors rec- 
ognize this need. The DOE safety apparatus is improving and is 
striving to meet its obligations. In this connection, it is important to 
recognize that DOE itself requested the committee^s scrutiny of the 
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Class A reactors and has embarked on extensive efforts to respond to 
the recommendations m the previous report. These steps are healthy 
signs. Nonetheless, the dedication to improving reactor safety can- 
not be episodic. There must be a vital, continuous, and long-term 
commitment to safety that permeates all levels of DOE and the con* 
tractor organizations. The relationship between the department and 
its contractors must be a partnership of conmion goals, complemen* 
tary capabilities, and, most importantly, mutual dedication to the 
safety of the reactors and the protection of operating personnel and 
the public. 
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Test Device. Memorandum from D. Art to Q. L. Balrd et al. (with 
attachments). September 30, 19851. 

Westinghouse Hanford Company. HEDL-TC-2732, FFTF Core Demonstration 
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(with attachment). April 28, 1986r. 
Westinghouse Hanford Company. Test Specifications: S8B • Measurement of 

GEM Worth, P8B - Delayed Pony Motor TVip Test. Letter from J. J. 
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Westinghouse Hanford Company. Calculation of Three-Dimension al to Two- 
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Safety Test3 Using the SASSYS Code. A. Padilla, Jr. September 1987m. 
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ing, Management Information. D. J. Newland. WHC-EF-0099. November 
1987q. 

Westinghouie Hanford Company. FTR Insertion Approval for the FFTF Series 
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Westinghouse Hanford Company. Memorandum from B. Ritter to J. LoScalso 
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Rev. 1. December 18, 1987w. 
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p. J. Newland to S. Blush (NAS). December 18, 1987x. 
Westinghouse Hanford Company. Radiation Protection. Management Policies 
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Westinghouse Hanford Company. Nuclear Reactor Safety. Management Re- 
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Westinghouse Hanford Company. Revised Independent Safety Analysis Limits 
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Appendix A 
Statement of Task 



The National Research Council will undertake an assessment of 
safety and technical issues raised by the nuclear reactor accident at 
Chernobyl. The assessment will focus on the eleven Class A (over 
20 MWT) reactors operated by the Department of Energy. These 
eleven reactors are the N Reactor at Hanford; the C, K, L, and P 
production reactors at Savannah River; the Fast Flux Test Facility 
at Hanford; the Experimental Breeder 11 and the Advanced Test 
Reactor at Idaho Falls; the High Flux Beam Reactor at Brookhaven; 
and the High Flux Isotope Reactor and Oak Ridge Research Reactor 
at Oak Ridge. 

The committee of individuals expert in nuclear reactor safety, 
risk analysis and assessment, and management of large production 
and research programs, will carry out the review. The committee will 
obtain the results of DOE's ongoing safety assessments of production 
reactors and will receive briefings on what is known about the Cher- 
nobyl accident. In addition, the conmiittee will respond to Secretary 
Herrington's request for public participation by holding public meet* 
ikiZ" receive ideas and information from interested individuals and 
groups. 

This Statement of Task is taken largely from the August 1986 contract 
between the U.S. Department of Bnergy and the National Academy of Sciences- 
National Research Council. 
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The committee will report within nine monthe on matters of 
immediate safety concern for DOE reactor design, coristruction, and 
operation. It is expected that the committee will consider a number 
of more generic, perhaps longer-term, safety issues that arise from a 
more complete understanding of the Chernobyl accident; these will 
be discussed in a later report. 
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Appendix B 
Biographical Sketches of Committee 
Members 



RICHARD A. MESERVE is a partner in the Washington law 
IBrm of Covington k Burling. He holds both a law degree from Har- 
vard Law School and a Ph.D. degree in applied physics from Stanford 
University, where he did postdoctoral work on the theoretical proper- 
ties of paramagnets and techniques to calculate molecular properties. 
In 1976, he was a clerk for Supreme Court Justice Harry A. Black- 
mun, and in 1977, he was appointed Legal Counsel and Senior Policy 
Analyst in the White House Office of Science and Technology Policy 
(OSTP). At OSTP he helped develop policies designed to promote 
the technological advance of American industry and conducted re- 
views of energy technology issues. In addition, he served as executive 
director of an interagency committee concerned with nuclear power 
plant safety. Mr. Meserve has been a member of several study com- 
mittees of the National Research Council, including most recently 
the Panel to Study the Impact of National Security Controls on 
International Technology Transfer. 

DAVID C. ALDRICH is a vice president at Science Applica- 
tions International Corporation (SAIC). He has worked primarily on 
nuclear facility safety and waste management problems, and is an 
expert in radiological accident health and environmental and eco- 
nomic consequence evaluation. Prior to joining SAIC, Dr. Aldrich 
was supervisor of the Safety and Environmentad Studies Division of 
Sandia National Laboratories, where he worked on a wide variety of 
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reactor safety issues, including management of an NRC-sponsored 
program to develop a new set of risk assessment computer codes cov- 
ering thermal-hydraulic behavior, fission product source terms, and 
offsite consequences of severe reactor accidents. He is a member of 
an International Atomic Energy Agency (IAEA) advisory group on 
emergency response decision making, and is active in the Organiza- 
tion for Economic Cooperation and Development (OECD) Nuclear 
Energy Agency (NEA), having served as chairman of NEA's Group 
of Experts on Radiological Accident Consequences. 

GEORGE APOSTOLAKIS is a professor in the Mechanical, 
Aerospace, and Nuclear Engineering Department of the University 
of California, Los Angeles. His research activities are in the devel- 
opment of methods for the assessment of risks from complex techno- 
logical systems, nuclear reactor safety, and toxic waste disposal. He 
has published extensively on data analysis, human error modeling, 
and fire risk assessment. He has been a consultant on probabilistic 
risk assessment to private industry, government, national laborato- 
ries, and international organizations. He is a foundmg member and 
currently the president of the Southern California Chapter of the 
Society for Risk Analysis. He is also a vice president of the Ameri- 
can Association for Structural Mechanics in Reactor Technology. He 
is coeditor of the international journal ReUability Engineering and 
System Safety. 

RICHARD S. DENNING is senior research leader for nuclear 
safety at Columbus Laboratories, Battelle Memorial Institute. He is 
an expert in radioactive source term and severe accident research. 
His work focuses on reactor safety and risk, including core meltdown 
behavior, radionuclide transport, transient thermal hydraulics, and 
criticality and shielding analysis. He holds a Ph.D. degree in nuclear 
engineering from the University of Florida. He is currently a member 
of the DOE Advisory Conmiittee on Nuclear Facility Safety. 

RONALD GAUSDEN is currently a consultant on nuclear en- 
ergy. He is the former chief inspector of the Nuclear Installations In- 
spectorate (Nil) of the U.K. Health and Safety Executive. From 1960 
to 1978, Mr. Gausden served in a number of supervisory positions at 
the Nn. Prior to that, he was group manager at Windscale, where in 
1957 a production reactor overheated during a Wegner energy release 
causing a graphite fire and release of radioactive particulates. He has 
authored papers for professional conferences on nuclear safety stan- 
dards and nuclear power plant regulatory procedures, and in 1982 
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was awarded the C.B. for meritorious public service by Her Majesty 
the Queen. 

DAVID L. HETRICK is professor of nuclear and energy engi- 
neering at the University of Arizona in Tucson. His research mterests 
center on reactor dynamics and simulation. He is an administrative 
judge for the U.S. Nuclear Regulatory Coimnission, and has served 
as an IAEA technical expert on assignment to Mexico's Instituto de 
Investigaciones Electricas. Dr. Hetrick has also been a visiting pro- 
fessor of nuclear engineering at the University of Bologna, Italy. He 
has served as a consultant on reactor dynamics to government and 
industry and is the author of numerous articles on reactor physics 
and nuclear safety. 

WILLIAM KASTENBERG is chairman of the Mechanical, Aero- 
space, and Nuclear Engineering Department at the University of Cal- 
ifornia, Los Angeles. His research focuses on nuclear reactor safety, 
the development of risk-benefit and cost-benefit analysis, and envi* 
ronmental modeling for nuclear power installations. He has served 
as a senior fellow of the Advisory Committee on Reactor Safeguards, 
where he developed methods for applying probabilistic acceptance 
criteria to nuclear and nonnuclear technologies. He has been a con- 
sultant to a number of other governmental panels, including the 
President's Nuclear Safety Oversight Conmiittee. He is the author 
of over 100 journal and proceedings publications relating to reactor 
safety and risk assessment, and recently served as a member of the 
National Research Council's Committee on Nuclear Safety Research. 

HERBERT KOUTS is chairman of the Department of Nuclear 
Energy at Brookhaven National Laboratory. He was the first di- 
rector of the Nuclear R'^gulatory Commission's Office of Nuclear 
Regulatory Research, having previously headed the Division of Re- 
actor Safety Research at the Atomic Energy Conmiission. He is a 
former member and chairman of the Advisory Conmuttee on Re- 
actor Safeguards, and has been affiliated, either as a consultant or 
as a member, with a number of national and international groups 
focusing on reactor safety and safeguards, including the NRC's Risk 
Assessment Review Group, the President's Nuclear Safety Oversight 
Committee, the European- American Conmiittee on Reactor Physics, 
the DOE Defense Energy Tisk Force, the American Nuclear Society 
(ANS) Special Committee on Source Terms, and several New York 
City and State advisory commissions on nuclear issues. He has also 
served on several advisory panels to review the safety of the N Re- 
actor and the Fast Flux Test Facility. He is currently a member of 
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the IAEA's International Nuclear Safety Advisory Group and the 
National Academy of Engineering, and is the recipient of several 
distinguished awards. 

DaVID D. LANNING is professor of nuclear engineering at the 
Massachusetts Institute of Technology. He has been a consultant to 
a number of firms active in the electric utility and nuclear industries, 
including Stone and Webster Engineering Corporation, Northern ' 
States Power, Boston Edison, and GA Technologies. His professional 
interests include nuclear engineering education and the design, safety, 
control, and operation cf nuclear reactor systems. In the 1950s he 
worked for General Electric at Hanford and in the 1960s for Battelle 
Northwest Laboratories. At MIT during the 1970s he was codirector 
of the MIT Research Reactor with the responsibility for the design 
and installation of the MIT R-II. He has also been a co-principal 
investigator of MIT's Program on Nuclear Power Plant Innovation 
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